Alarm method, device, electronic device and storage medium

Abstract

The present invention relates to an alarm method, device, electronic device, and storage medium, and belongs to the field of alarm technology. The method includes: obtaining first monitoring data for a monitoring indicator; dividing the first monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each time granularity; determining the abnormality of each second monitoring data; and generating alarm information based on the abnormality of each second monitoring data. The present invention can more comprehensively characterize the changes in the first monitoring data by observing and judging the first monitoring data at different time granularities, thereby generating alarm information based on the observation results of the first monitoring data at each time granularity, that is, based on the abnormality of each second monitoring data, so as to make the alarm more accurate.

Description

Technical Field

[0001] The present invention relates to the field of alarm technology, and in particular to an alarm method, device, electronic equipment and storage medium. Background Art

[0002] In industrial production, timely and accurate detection of equipment operating anomalies and triggering alarms are crucial. Traditional alarm systems rely primarily on pre-set thresholds, triggering alarms when monitored indicators exceed them. However, this single threshold fails to capture the dynamic characteristics of complex systems, and relying solely on a single threshold to trigger alarms results in inaccurate and untimely alerts. Summary of the Invention

[0003] In view of this, it is necessary to provide an alarm method, device, electronic device and storage medium to solve the problem that the alarm is not timely and accurate in the related art.

[0004] In order to solve the above problems, in a first aspect, the present invention provides an alarm method, comprising:

[0005] Acquire first monitoring data for a monitoring indicator;

[0006] Dividing the first monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each of the time granularities;

[0007] determining abnormality of each of the second monitoring data;

[0008] Generate alarm information according to the abnormal conditions of each of the second monitoring data.

[0009] Optionally, determining the abnormality of each second monitoring data includes:

[0010] Dividing the second monitoring data corresponding to each of the time granularities according to a preset time window to obtain third monitoring data corresponding to each time window in each of the time granularities;

[0011] Determine a first statistical feature of the third monitoring data corresponding to a current time window and a second statistical feature of the third monitoring data corresponding to a historical time window in each of the time granularities; wherein the current time window is a time window in which a current time node is located, and the historical time window is a time window in which a historical time node is located;

[0012] An abnormality score of the second monitoring data corresponding to each of the time granularities is determined according to a difference between the first statistical feature and the second statistical feature in each of the time granularities.

[0013] Optionally, the first statistical feature includes a mean and a standard deviation, and the second statistical feature includes an average feature.

[0014] Optionally, the abnormal situation includes an abnormality score; then, generating alarm information according to the abnormal situation of each second monitoring data includes:

[0015] Obtaining a fuzzy rule, where the fuzzy rule is used to describe a mapping relationship between anomaly scores and alarm levels of each of the second monitoring data;

[0016] A target alarm level is determined according to the fuzzy rule and the abnormality score of each second monitoring data, and alarm information is generated according to the target alarm level.

[0017] Optionally, the fuzzy rules include a plurality of rules, each of which includes a rule antecedent and a rule consequent, the rule antecedent being used to describe a triggering condition of the fuzzy rule, the triggering condition being set according to anomaly scores of each second monitoring data; the rule consequent being used to indicate an alarm level to be output when the fuzzy rule is triggered; then, determining a target alarm level according to the fuzzy rules and anomaly scores of each second monitoring data includes:

[0018] Determining, based on the rule antecedents of the respective fuzzy rules and the anomaly scores of the respective second monitoring data, the matching degrees of the anomaly scores and the rule antecedents of the respective fuzzy rules;

[0019] Determining whether the matching degree is greater than a preset matching degree threshold;

[0020] If the matching degree is greater than a preset matching degree threshold, the fuzzy rule corresponding to the matching degree is used as the target fuzzy rule, and the alarm level set in the target fuzzy rule is output;

[0021] According to the output alarm level, the target alarm level is determined.

[0022] Optionally, the target fuzzy rules include multiple ones; then determining the target alarm level according to the output alarm level includes:

[0023] The output multiple alarm levels are defuzzified to obtain the target alarm level.

[0024] Optionally, the alarm information includes at least one of an alarm time, the target alarm level, an abnormality score of each second monitoring data, and a target fuzzy rule.

[0025] In a second aspect, the present invention further provides an alarm device, comprising:

[0026] A monitoring data acquisition module, configured to acquire first monitoring data for a monitoring indicator;

[0027] A monitoring data division module, configured to divide the monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each of the time granularities;

[0028] an abnormality determination module, configured to determine an abnormality of each of the second monitoring data;

[0029] The alarm information generating module is used to generate alarm information according to the abnormal conditions of each of the second monitoring data.

[0030] In a third aspect, the present invention also provides an electronic device comprising a memory and a processor, wherein the memory is used to store a program; and the processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in any one of the above-mentioned alarm methods.

[0031] In a fourth aspect, the present invention further provides a computer-readable storage medium for storing a computer-readable program, wherein the program or instructions, when executed by a processor, can implement the steps in any one of the above-mentioned alarm methods.

[0032] The beneficial effects of the present invention are:

[0033] After acquiring first monitoring data for a monitoring indicator, the present invention divides the monitoring data according to multiple preset time granularities to obtain second monitoring data corresponding to each time granularity, and separately determines the abnormality of each second monitoring data. The first monitoring data can be observed and judged at different time granularities, more comprehensively depicting the changes in the first monitoring data at short-term, medium-term, and long-term time granularities. Furthermore, based on the observation results of the first monitoring data at each time granularity, that is, based on the abnormality of the second monitoring data corresponding to each time granularity, alarm information is generated, which can make the alarm more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic flow chart of an embodiment of the alarm method provided by the present invention;

[0035] Figure 2 For the present invention Figure 1 A schematic flow chart of an embodiment of S103;

[0036] Figure 3 For the present invention Figure 1 A schematic flow chart of an embodiment of S104;

[0037] Figure 4 This is a structural diagram of an embodiment of the alarm device provided by the present invention. DETAILED DESCRIPTION

[0038] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0039] In the description of the embodiments of the present invention, unless otherwise specified, "plurality" means two or more. "And / or" describes the association relationship between associated objects, indicating that three relationships can exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone.

[0040] The terms "first," "second," and so on, used in the embodiments of the present invention are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, technical features designated as "first" or "second" may explicitly or implicitly include at least one such feature.

[0041] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0042] Reference Figure 1 , shows a flow chart of an embodiment of the alarm method provided by the present invention, the method comprising:

[0043] S101: Acquire first monitoring data for a monitoring indicator.

[0044] S102: Divide the monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each time granularity.

[0045] S103: Determine the abnormality of each second monitoring data.

[0046] S104: Generate alarm information according to the abnormal conditions of each second monitoring data.

[0047] The execution subject of the embodiment of the present invention can be a mobile phone, tablet, computer, smart wearable device or other types of electronic devices, etc., which is not limited here.

[0048] The monitoring indicators in the embodiment of the present invention may be indicators such as temperature, noise, and operating parameters of the equipment, and the types of monitoring indicators are not limited here.

[0049] The first monitoring data may be real-time detection and recording data for a monitoring indicator. For example, when the monitoring indicator is temperature, the first monitoring data may be real-time detection and recording data for the device temperature.

[0050] The preset time granularity may include multiple, multiple time granularity can be increased in sequence. For example, m time granularities g1, g2, ..., gm can be selected based on prior knowledge, and m time granularities satisfy g1 <g2<…<gm。

[0051] After obtaining the first monitoring data and multiple preset time granularities, the first monitoring data can be divided according to the time granularity with the most recent time node in the first monitoring data as the time starting point to obtain the second monitoring data corresponding to each time granularity. For example, m=3, g1=5 minutes, g2=30 minutes, g3=60 minutes, and the first monitoring data is the monitoring data for the device temperature in the time period of 5:00-6:00. Then, the second monitoring data corresponding to the g1 time granularity is the monitoring data for the device temperature in the time period of 5:55-6:00; the second monitoring data corresponding to the g2 time granularity is the monitoring data for the device temperature in the time period of 5:30-6:00; and the second monitoring data corresponding to the g3 time granularity is the monitoring data for the device temperature in the time period of 5:00-6:00.

[0052] After dividing the first monitoring data into multiple preset time granularities, the anomaly of the second monitoring data corresponding to each time granularity can be determined. The anomaly can be represented by an anomaly score or by a low, medium, or high anomaly level; the specific method for representing the anomaly is not limited here. Finally, the anomaly of the second monitoring data corresponding to each time granularity can be combined to generate an alarm message.

[0053] In the field of industrial production, traditional alarm systems mainly rely on pre-set thresholds, and alarms are triggered when monitoring indicators exceed the thresholds. However, this single threshold is difficult to characterize the dynamic characteristics of complex systems, which results in alarms that are not timely and accurate enough. With the rapid development of artificial intelligence, there are also methods for constructing anomaly detection models for alarm systems by training historical data, but most existing machine learning methods only target data of a single time granularity, lack modeling of multi-time scale features, and have limited model generalization capabilities. Therefore, in an embodiment of the present invention, by observing the dynamic changes of the first monitoring data at different time scales, comprehensively characterizing the abnormal conditions of the first monitoring data, and comprehensively generating alarm information based on the abnormal conditions of the first monitoring data at various time scales, the alarm can be made more accurate and timely.

[0054] Reference Figure 2 , showing the present invention Figure 1 The flowchart of an embodiment of S103 is shown in FIG. 1 , and the specific implementation steps of S103 may include:

[0055] S201 : Divide the second monitoring data corresponding to each time granularity according to a preset time window to obtain third monitoring data corresponding to each time window in each time granularity.

[0056] S202, determine the first statistical feature of the third monitoring data corresponding to the current time window in each time granularity, and the second statistical feature of the third monitoring data corresponding to the historical time window; wherein, the current time window is the time window where the current time node is located, and the historical time window is the time window where the historical time node is located.

[0057] S203 : Determine an anomaly score of the second monitoring data corresponding to each time granularity according to the difference between the first statistical feature and the second statistical feature in each time granularity.

[0058] In this embodiment, the second monitoring data corresponding to each time granularity can be further divided according to the preset time window. For example, if the preset time window is 1 minute, and the second monitoring data corresponding to the g1 time granularity is the monitoring data for the device temperature in the time period of 5:55-6:00, then the g1 time granularity can be divided into 5 time windows, and the third monitoring data corresponding to the 5 time windows are: the monitoring data for the device temperature in the time period of 5:59-6:00, the monitoring data for the device temperature in the time period of 5:58-5:59, the monitoring data for the device temperature in the time period of 5:57-5:58, and so on.

[0059] After the division, the third monitoring data corresponding to the current time window and the third monitoring data corresponding to the historical time window within each time granularity can be determined. Among them, the current time window is the time window where the current time node is located. Continuing with the above example, 5:59-6:00 is the time window where the current time node is located. The historical time window is the time window where the historical time node is located. Continuing with the above example, the four time nodes corresponding to 5:55-5:59 are the time windows where the historical time nodes are located.

[0060] Furthermore, feature extraction can be performed on the third monitoring data corresponding to the current time window and the third monitoring data corresponding to the historical time window at each time granularity to obtain a first statistical feature and a second statistical feature, respectively. The first statistical feature and the second statistical feature are then calculated using a calculation method such as the Euclidean distance calculation formula to obtain a difference measure between the two. Finally, the difference measure corresponding to each time granularity can be normalized using Sigmoid to obtain an anomaly score corresponding to each time granularity. The first statistical feature can be a mean, standard deviation, etc., and the second statistical feature can be an average feature, etc.

[0061] Reference Figure 3 , showing the present invention Figure 1 Detailed steps of S104 may include:

[0062] S301: Obtain fuzzy rules, where the fuzzy rules are used to describe the mapping relationship between the abnormality score and the alarm level of each second monitoring data.

[0063] S302 : determining a target alarm level according to the fuzzy rules and the abnormality scores of each second monitoring data, and generating alarm information according to the target alarm level.

[0064] Fuzzy rules are the core component of fuzzy logic systems and are used to process and reason about information with uncertainty and ambiguity. Fuzzy rules can be constructed based on domain expert knowledge. The fuzzy rules constructed in this embodiment can be used to describe the mapping relationship between the anomaly score and the alarm level corresponding to each time granularity. For example, when the anomaly score corresponding to the g1 time granularity is high, the alarm level is severe; when the anomaly score corresponding to the g1 time granularity is low, the anomaly score corresponding to the g2 time granularity is low, and the anomaly score corresponding to the g3 time granularity is low, the alarm level is normal.

[0065] According to the fuzzy rules and the abnormality scores of each second monitoring data, the target alarm level can be determined.

[0066] This embodiment introduces fuzzy rules, which are usually constructed based on domain expert knowledge. Therefore, this embodiment can combine more domain expert knowledge to judge abnormal situations of monitoring data, making the judgment more accurate.

[0067] In one embodiment, a fuzzy rule base may be constructed. The fuzzy rule base may be constructed as follows:

[0068] Step 1: Define linguistic variables. Define linguistic variables representing anomaly scores at each time granularity and linguistic variables representing alarm levels.

[0069] For example, you can define nine language variables: g1_low, g1_medium, g1_high; g2_low, g2_medium, g2_high; g3_low, g3_medium, g3_high, representing the anomaly score levels at the three time granularities of g1, g2, and g3, respectively. Furthermore, you can define three language variables: alarm_critical, alarm_warning, and alarm_normal, representing the three alarm levels, respectively.

[0070] Step 2: Define the membership function. Define a series of fuzzy subsets for each linguistic variable and define the corresponding membership function. The membership function can be constructed using trigonometric functions combined with trapezoidal functions.

[0071] Step 3: Generate fuzzy rules. Based on expert knowledge, a series of IF-THEN fuzzy rules are generated to describe the correspondence between multi-granularity anomaly scores and alarm levels.

[0072] For example, rule 1: If the short-term monitoring indicator g1 score is high g1_high, the alarm level is severe alarm_critical;

[0073] Rule 2: If the mid-term monitoring indicator g2 is scored as g2_high and the long-term monitoring indicator g3 is scored as medium, the alarm level is warning alarm_warning;

[0074] Rule 3: If the short-term monitoring indicator g1 is low, the medium-term monitoring indicator g2 is low, and the long-term monitoring indicator g3 is low, then the alarm level is normal alarm_normal;

[0075] The fuzzy rules defined in this embodiment are only used as an example, and the fuzzy rules can be designed according to the usage scenario.

[0076] In one embodiment, the fuzzy rules may include multiple rules, each of which includes a rule antecedent and a rule consequent. The rule antecedent is used to describe the triggering condition of the fuzzy rule, and the triggering condition is set according to the anomaly score of each second monitoring data; the rule consequent is used to indicate the output alarm level when the fuzzy rule is triggered; then, step S302 may specifically include: determining the matching degree between the anomaly score and the rule antecedent of each fuzzy rule according to the rule antecedent of each fuzzy rule and the anomaly score of each second monitoring data; judging whether the matching degree is greater than a preset matching degree threshold; if the matching degree is greater than the preset matching degree threshold, taking the fuzzy rule corresponding to the matching degree as the target fuzzy rule, and outputting the alarm level set in the target fuzzy rule; and determining the target alarm level according to the output alarm level.

[0077] Continuing with the above example, in Rule 1, the rule antecedent is: If the short-term monitoring indicator g1 scores high (g1_high), and the rule consequent is: Then the alarm level is severe (alarm_critical). The triggering probability of each fuzzy rule can be calculated by combining the anomaly scores corresponding to each time granularity. This means calculating the degree of match between the anomaly score and the antecedent of each fuzzy rule. When the match exceeds the preset matching threshold, the fuzzy rule is determined to be triggered, and the alarm level set in the fuzzy rule is output. For example, if the matching threshold is 0.6, and the matching degree between the anomaly score and the antecedent of Rule 1 is 0.7, which is greater than the matching threshold, the output alarm level is alarm_critical.

[0078] In one embodiment, the target fuzzy rules include multiple ones; then, step S302 may specifically include: performing defuzzification processing on the output multiple alarm levels to obtain the target alarm level.

[0079] When multiple target fuzzy rules are included, that is, when multiple fuzzy rules are triggered, multiple alarm levels are output. For example, when both Rule 1 and Rule 2 are triggered, two alarm levels are output. To obtain a clear final alarm level (target alarm level), the center of gravity method or other similar defuzzification methods can be used to convert the multiple output alarm levels into a specific, clear target alarm level. The executing entity can then take appropriate actions or issue an alarm based on the target alarm level.

[0080] In one embodiment, the alarm information includes at least one of an alarm time, a target alarm level, an abnormality score of each second monitoring data, and a target fuzzy rule.

[0081] Reference Figure 4 , shows a schematic structural diagram of an embodiment of the alarm device provided by the present invention. The alarm device 400 may specifically include the following modules:

[0082] A monitoring data acquisition module 401 is used to acquire first monitoring data for a monitoring indicator;

[0083] The monitoring data division module 402 is used to divide the monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each time granularity;

[0084] An abnormality determination module 403, configured to determine an abnormality of each second monitoring data;

[0085] The alarm information generating module 404 is configured to generate alarm information according to abnormal conditions of each second monitoring data.

[0086] It should be noted that the implementation principles or implementation processes of the above modules can refer to the embodiments of the above alarm method, and will not be described in detail here.

[0087] In one embodiment, the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of any of the above-mentioned alarm methods are implemented.

[0088] In one embodiment, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by the processor, the steps of any one of the above-mentioned alarm methods are implemented.

[0089] Those skilled in the art will appreciate that all or part of the process steps of the above-described embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, such as a magnetic disk, an optical disk, a read-only memory, or a random access memory.

[0090] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed by the present invention should be covered by the scope of protection of the present invention.

Claims

1. An alarm method, characterized in that: include: Acquire first monitoring data for a monitoring indicator; Dividing the first monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each of the time granularities; determining abnormality of each of the second monitoring data; generating alarm information according to abnormal conditions of each of the second monitoring data; The determining of the abnormality of each of the second monitoring data includes: Dividing the second monitoring data corresponding to each of the time granularities according to a preset time window to obtain third monitoring data corresponding to each time window in each of the time granularities; Determine a first statistical feature of the third monitoring data corresponding to a current time window and a second statistical feature of the third monitoring data corresponding to a historical time window in each of the time granularities; wherein the current time window is a time window in which a current time node is located, and the historical time window is a time window in which a historical time node is located; An abnormality score of the second monitoring data corresponding to each of the time granularities is determined according to a difference between the first statistical feature and the second statistical feature in each of the time granularities.

2. The alarm method according to claim 1, characterized in that: The first statistical feature includes a mean and a standard deviation, and the second statistical feature includes an average feature.

3. The alarm method according to claim 1, characterized in that: The abnormal situation includes an abnormality score; then generating alarm information according to the abnormal situation of each second monitoring data includes: Obtaining a fuzzy rule, where the fuzzy rule is used to describe a mapping relationship between anomaly scores and alarm levels of each of the second monitoring data; A target alarm level is determined according to the fuzzy rule and the abnormality score of each second monitoring data, and alarm information is generated according to the target alarm level.

4. The alarm method according to claim 3, characterized in that: The fuzzy rules include a plurality of rules, each of which includes a rule antecedent and a rule consequent, wherein the rule antecedent is used to describe a triggering condition of the fuzzy rule, and the triggering condition is set according to anomaly scores of each second monitoring data; and the rule consequent is used to indicate an alarm level to be output when the fuzzy rule is triggered; Then, determining the target alarm level according to the fuzzy rule and the abnormality score of each second monitoring data includes: Determining, based on the rule antecedents of the respective fuzzy rules and the anomaly scores of the respective second monitoring data, the matching degrees of the anomaly scores and the rule antecedents of the respective fuzzy rules; Determining whether the matching degree is greater than a preset matching degree threshold; If the matching degree is greater than a preset matching degree threshold, the fuzzy rule corresponding to the matching degree is used as the target fuzzy rule, and the alarm level set in the target fuzzy rule is output; According to the output alarm level, the target alarm level is determined.

5. The alarm method according to claim 4, characterized in that: The target fuzzy rules include multiple ones; then determining the target alarm level according to the output alarm level includes: The output multiple alarm levels are defuzzified to obtain the target alarm level.

6. The alarm method according to claim 5, characterized in that: The alarm information includes at least one of an alarm time, the target alarm level, an abnormality score of each second monitoring data, and a target fuzzy rule.

7. An alarm device, characterized in that: include: A monitoring data acquisition module, configured to acquire first monitoring data for a monitoring indicator; a monitoring data division module, configured to divide the first monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each of the time granularities; an abnormality determination module, configured to determine an abnormality of each of the second monitoring data; an alarm information generating module, configured to generate alarm information according to abnormal conditions of each of the second monitoring data; The determining of the abnormality of each of the second monitoring data includes: Dividing the second monitoring data corresponding to each of the time granularities according to a preset time window to obtain third monitoring data corresponding to each time window in each of the time granularities; Determine a first statistical feature of the third monitoring data corresponding to a current time window and a second statistical feature of the third monitoring data corresponding to a historical time window in each of the time granularities; wherein the current time window is a time window in which a current time node is located, and the historical time window is a time window in which a historical time node is located; An abnormality score of the second monitoring data corresponding to each of the time granularities is determined according to a difference between the first statistical feature and the second statistical feature in each of the time granularities.

8. An electronic device, characterized in that: comprising a memory and a processor, wherein, The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps of the alarm method described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that Used to store computer-readable programs, which, when executed by a processor, can implement the steps of the alarm method described in any one of claims 1 to 6.

Images