Alarm information clustering method and device, computer equipment and storage medium

Abstract

The embodiment of the invention belongs to the field of artificial intelligence and information clustering, and relates to an alarm information clustering method, which comprises the following steps: acquiring original alarm data which comprises an alarm data format, performing format preprocessing on the original alarm data based on the alarm data format to obtain alarm data to be converged, and sending the alarm data to be converged to a server; and according to a preset layering condition, carrying out layering convergence clustering processing on the alarm data to be converged to obtain convergence alarm data, and according to a preset convergence template and dimension granularity, classifying the convergence alarm data to determine a corresponding alarm data list. According to the method and the device, the hierarchical convergence clustering processing is performed on the original alarm data through the preset hierarchical condition and the preprocessing, and the convergence alarm data is classified in combination with the dimension granularity, so that the efficiency of distinguishing and classifying the same kind of alarm data is improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence and information clustering technology, and in particular to an alarm information clustering method, device, computer equipment and storage medium. Background Art

[0002] In modern network management and monitoring systems, alarm processing and management are key components to ensure system stability and efficiency. Alarm information is collected from various network devices and systems, including but not limited to servers, routers, and other communication devices. This data usually covers various performance indicators and potential system anomalies.

[0003] However, the traditional alarm information clustering method cannot effectively distinguish and classify the alarm information, so it will generate a large amount of identical alarm information, which makes the alarm information redundant and eventually leads to the outbreak of large-scale alarm information when the core function of the system is abnormal, causing it to ignore the core root cause alarm information. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose an alarm information clustering method, device, computer equipment and storage medium to solve the problem of generating a large amount of identical alarm information, which makes the alarm information redundant and eventually leads to the outbreak of large-scale alarm information when the core function of the system is abnormal, causing it to ignore the core root cause alarm information.

[0005] In order to solve the above technical problems, the embodiment of the present application provides a method for clustering alarm information, which adopts the following technical solution:

[0006] Acquire original alarm data, wherein the original alarm data includes an alarm data format;

[0007] Based on the alarm data format, format preprocessing is performed on the original alarm data to obtain alarm data to be converged;

[0008] According to preset hierarchical conditions, the to-be-converged alarm data is subjected to hierarchical convergence clustering processing to obtain convergence alarm data;

[0009] According to the preset convergence template and dimensional granularity, the convergence alarm data is classified to determine the corresponding alarm data list.

[0010] Furthermore, the alarm data format includes fixed format data and variable format data, and the step of performing format preprocessing on the original alarm data based on the alarm data format to obtain the alarm data to be converged includes:

[0011] Obtain fixed format data and variable format data of original alarm data;

[0012] Performing wildcard processing on the variable format data to obtain wildcard character data;

[0013] The fixed format data and the corresponding wildcard character data are merged to determine the corresponding alarm data to be converged.

[0014] Furthermore, the step of performing hierarchical convergence clustering processing on the to-be-converged alarm data according to preset hierarchical conditions to obtain convergence alarm data includes:

[0015] In the first convergence layer, if the wildcard character data corresponding to the at least two alarm data to be converged are exactly the same, the at least two alarm data to be converged are converged to obtain converged alarm data; if the wildcard character data corresponding to the at least two alarm data to be converged are not exactly the same, the second convergence layer processes them;

[0016] In the second convergence layer, if there is a separator in the at least two alarm data to be converged, the alarm data to be converged is segmented according to the separator, and the similarity of the segmented wildcard character part is calculated. If the similarity is greater than the character similarity threshold, the at least two alarm data to be converged are converged to obtain converged alarm data. If the similarity is less than or equal to the similarity threshold, the third convergence layer is used for processing;

[0017] In the third convergence layer, the similarity of the text contents of the wildcard character data corresponding to the at least two alarm data to be converged is calculated. If the similarity is greater than the text similarity threshold, the at least two alarm data to be converged are converged to obtain converged alarm data. If the similarity is less than or equal to the text similarity threshold, the two alarm data to be converged are not converged clustered.

[0018] Furthermore, before classifying the convergence alarm data according to the preset convergence template and the dimension granularity and determining the corresponding alarm data list, the method further includes:

[0019] Determine the wildcard character data features corresponding to the convergence alarm data under the preset layering conditions;

[0020] Based on the wildcard character data feature, a preset convergence template for the current convergence alarm data is determined.

[0021] Furthermore, the step of classifying the convergence alarm data according to the preset convergence template and dimensional granularity and determining the corresponding alarm data list includes:

[0022] Get the wildcard character of the preset convergence template;

[0023] Matching the convergence alarm data based on the wildcard characters of the preset convergence template, and assigning the successfully matched convergence alarm data to the first alarm data list;

[0024] In the first alarm data list, convergence alarm data with the same dimensional granularity is determined and allocated to the second alarm data list.

[0025] Further, the dimension granularity includes an intranet IP, an extranet IP, and an alarm time granularity, and the step of determining, in the first alarm data list, convergence alarm data having the same dimension granularity and allocating it to the second alarm data list includes:

[0026] In the first alarm data list, the convergence alarm data with the same intranet IP and extranet IP are clustered to obtain a convergence alarm data cluster;

[0027] In the convergence alarm data cluster, convergence alarm data with the same alarm time granularity are merged and allocated to the corresponding second alarm data list.

[0028] Further, after the step of determining convergence alarm data with the same dimension granularity in the first alarm data list and allocating them to the second alarm data list, the method further includes:

[0029] Acquire new convergence alarm data, and match the wildcard characters of the new convergence alarm data with the wildcard characters of the convergence alarm data in the second alarm data list;

[0030] If the match is successful, the new convergence alarm data is assigned to the corresponding second alarm data list;

[0031] If the match fails, a corresponding new preset convergence template is generated based on the wildcard character corresponding to the new convergence alarm data.

[0032] In order to solve the above technical problems, the embodiment of the present application further provides an alarm information clustering device, which adopts the following technical solution:

[0033] A first acquisition module, used to acquire original alarm data, wherein the original alarm data includes an alarm data format;

[0034] A preprocessing module, configured to perform format preprocessing on the original alarm data based on the alarm data format to obtain alarm data to be converged;

[0035] A processing module, configured to perform hierarchical convergence clustering processing on the to-be-converged alarm data according to a preset hierarchical condition to obtain convergence alarm data;

[0036] The classification module is used to classify the convergence alarm data according to a preset convergence template and dimensional granularity, and determine a corresponding alarm data list.

[0037] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0038] A computer device comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the alarm information clustering method when executing the computer-readable instructions.

[0039] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0040] A computer-readable storage medium, characterized in that computer-readable instructions are stored on the computer-readable storage medium, and when the computer-readable instructions are executed by a processor, the steps of the alarm information clustering method are implemented.

[0041] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0042] The embodiment of the present application obtains original alarm data, the original alarm data includes an alarm data format, and based on the alarm data format, performs format preprocessing on the original alarm data to obtain alarm data to be converged, thereby ensuring data consistency and standardization, and performs hierarchical convergence clustering processing on the alarm data to be converged according to preset hierarchical conditions to obtain converged alarm data, thereby reducing the redundancy of alarm information and improving the pertinence and effectiveness of alarms. Finally, according to a preset convergence template and dimensional granularity, the convergence alarm data is classified to determine the corresponding alarm data list, thereby improving the manageability and response efficiency of the alarm data. The present application performs hierarchical convergence clustering processing on the original alarm data by preset hierarchical conditions and preprocessing, and classifies the convergence alarm data in combination with dimensional granularity, thereby improving the efficiency of distinguishing and classifying similar alarm data. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0045] Figure 2A flowchart of an embodiment of a method for clustering alarm information according to the present application;

[0046] Figure 3 is a structural schematic diagram of an embodiment of an alarm information clustering device according to the present application;

[0047] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0048] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0049] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0050] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0051] like Figure 1 As shown, the alarm information clustering system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0052] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0053] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to a laptop computer 1011, a tablet computer 1012 or a mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0054] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0055] It should be noted that the alarm information clustering method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the alarm information clustering device is generally set in the server / terminal device.

[0056] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0057] Continue to refer Figure 2 , shows a flow chart of an embodiment of a method for clustering alarm information according to the present application. The method for clustering alarm information comprises the following steps:

[0058] Step S201, obtaining original alarm data.

[0059] In this embodiment, the alarm information clustering method can be deployed in an alarm information clustering system. The alarm information clustering system can be constructed by a server or a server cluster. The server or server cluster can be any electronic device with functions such as (text recognition, text processing, data transmission, data storage), and the alarm information clustering method runs on the electronic device (for example, Figure 1 The server / terminal device shown in the figure) can receive the original alarm data through a wired connection or a wireless connection. It should be noted that the above wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0060] Specifically, the above original alarm data may include the corresponding time, alarm object name, alarm event and other contents that require the attention of the operation and maintenance personnel in the alarm information. Generally speaking, any data that needs to be used by the system to inform the operation and maintenance personnel of system abnormalities can be used as the above original alarm data and fed back to the operation and maintenance personnel or the above terminal device through the system.

[0061] The above-mentioned original alarm data may include but is not limited to the alarm data format, wherein the above-mentioned alarm data format may include but is not limited to fixed format data and variable format data. The above-mentioned fixed format data may be a data item for the name of the alarm object in the above-mentioned original alarm data, that is, the object for which the system issues an alarm can be determined through the fixed format data. It can be understood that for a certain data or an object in the system, it can be identified in advance through a data table, and then based on the fixed format data corresponding to the identification, it can be determined which data item in the system issues the alarm information.

[0062] The variable format data may include but are not limited to the alarm events and alarm time corresponding to the data items, and other data indicating the alarm content of the data items. It is understandable that the content and characteristics of the alarm information issued by the data items can be obtained and determined through the variable format data.

[0063] In this embodiment, the alarm information clustering system can obtain the alarm data format corresponding to the pre-identified data items through the data table, and determine the object and content of the current alarm information through system analysis, thereby improving the efficiency of alarm information recognition.

[0064] Step S202: Based on the alarm data format, format preprocessing is performed on the original alarm data to obtain alarm data to be converged.

[0065] In this embodiment, the above-mentioned preprocessing can be an operation process of performing preliminary clustering of the original alarm data by splitting and classifying the alarm data according to the characteristics of the corresponding fixed format data and the variable format data after parsing the alarm data format. It can be understood that the consistency and standardization of the alarm data can be ensured by preprocessing the original alarm data, so that subsequent processing will not cause recognition and judgment errors due to inconsistent formats.

[0066] In a possible embodiment, since the original data may come from multiple formats from different sources, the above-mentioned alarm information clustering system will parse and analyze the alarm data format of the acquired original alarm data, and process it according to the unified alarm data format in the system to convert it into data with the same standard alarm data format, thereby effectively simplifying the data processing process and improving the efficiency and accuracy of data processing.

[0067] Step S203: performing hierarchical convergence clustering processing on the convergence alarm data according to preset hierarchical conditions to obtain convergence alarm data.

[0068] In this embodiment, the preset hierarchical conditions may be a set of preset rules or parameters, which are applied in the convergence layer of the deep learning model to perform hierarchical convergence clustering processing on the alarm data to be converged. Generally speaking, the alarm information clustering system may perform hierarchical convergence clustering processing on the alarm data to be converged in a unified alarm data format according to the preset hierarchical conditions, and classify the alarm data to be converged with the same convergence conditions into one category, which may be a cluster cluster, etc., to obtain a plurality of convergence alarm data. It is understandable that the number of convergence alarm data may be determined according to the convergence conditions and the alarm data format parsing results of the alarm data to be converged.

[0069] In a possible embodiment, the alarm information clustering system performs hierarchical clustering processing on the convergence alarm data by presetting hierarchical conditions, so that the convergence alarm data is effectively aggregated and merged, thereby significantly reducing the number of processed alarms and improving efficiency. The convergence alarm data generated by this process will facilitate real-time monitoring and rapid response, greatly reduce redundant information, optimize resource allocation, improve system response speed and stability, and effectively support the efficient operation of network and system management.

[0070] Step S204: classify the convergence alarm data according to the preset convergence template and dimension granularity, and determine the corresponding alarm data list.

[0071] In this embodiment, the preset convergence template can be a tool for the alarm information clustering system to further classify and sort the convergence alarm data after the clustering process according to characteristic rules and standards. It can be understood that the preset convergence template can be used to guide the system to assign the converged convergence alarm data to the corresponding category list, so that subsequent operation and maintenance personnel can perform effective monitoring and management.

[0072] The above-mentioned dimension granularity may include but is not limited to time granularity, intranet IP and extranet IP, etc., which are detailed levels for more detailed data differentiation. It is understandable that this dimension granularity can be used to describe the most detailed level of each dimension in the convergence alarm data, such as time, location, specific IP address, etc. The appropriate selection of the above-mentioned dimension granularity can help to more accurately identify and respond to problems, optimize resource allocation, and improve the efficiency of alarm data processing and analysis. For example, in system monitoring, high-granularity data makes it possible to accurately track alarm problems of specific data items, while low-granularity data helps to quickly obtain an overview of alarm information for the overall system status.

[0073] In a possible embodiment, the alarm information clustering system analyzes the convergence alarm data by using the preset convergence template and selecting an appropriate dimension granularity, and allocates the convergence alarm data with the same characteristics to a corresponding alarm data list.

[0074] The embodiment of the present application obtains the original alarm data, which includes the alarm data format. Based on the alarm data format, the original alarm data is formatted and preprocessed to obtain the alarm data to be converged, thereby ensuring the consistency and standardization of the data. According to the preset hierarchical conditions, the alarm data to be converged is subjected to hierarchical convergence clustering processing to obtain the converged alarm data, thereby reducing the redundancy of the alarm information and improving the pertinence and effectiveness of the alarm. Finally, according to the preset convergence template and dimensional granularity, the convergence alarm data is classified and the corresponding alarm data list is determined, thereby improving the manageability and response efficiency of the alarm data. The present application performs hierarchical convergence clustering processing on the original alarm data by preset hierarchical conditions and preprocessing, and classifies the convergence alarm data in combination with the dimensional granularity, thereby improving the efficiency of distinguishing and classifying the same type of alarm data.

[0075] In some optional implementations of this embodiment, before step S202, the following steps are included:

[0076] Obtain fixed format data and variable format data of original alarm data;

[0077] Perform wildcard processing on variable format data to obtain wildcard character data;

[0078] The fixed format data and the corresponding wildcard character data are merged to determine the corresponding alarm data to be converged.

[0079] In this embodiment, the above-mentioned fixed format data can be a data item for the name of the alarm object in the above-mentioned original alarm data, that is, the object for which the system issues an alarm can be determined through the fixed format data. It can be understood that for a certain item of data or a certain object in the system, it can be identified in advance through a data table, and then the fixed format data corresponding to the identification can be obtained to determine which data item in the system issues the alarm information.

[0080] The variable format data may include but are not limited to the alarm events and alarm time corresponding to the data items, and other data indicating the alarm content of the data items. It is understandable that the content and characteristics of the alarm information issued by the data items can be obtained and determined through the variable format data.

[0081] In a possible embodiment, the alarm information clustering system obtains and analyzes the alarm information sent by the corresponding data item to obtain the fixed format data and the variable format data of the corresponding original alarm data.

[0082] The above-mentioned wildcard processing may refer to the process of unifying the above-mentioned variable format data. Specifically, the variable parts such as the IP address and the URL address contained in the above-mentioned variable format data may be generated by a unified wildcard form, such as *, to obtain a data format of "fixed format data + *", thereby completing the purpose of unifying the variable format data. It should be noted that the above-mentioned * can be used to describe any characteristic words that can summarize the content of the alarm information, and a plurality of different wildcard characters can be combined to obtain a wildcard character group. The function of the character group is consistent with that of the above-mentioned wildcard characters and is only used for changes in quantity. The above-mentioned characteristic words may include but are not limited to system abnormality, connection timeout, etc., that is, wildcard characters and wildcard character groups such as *, ? or *? can replace the above-mentioned characteristic words.

[0083] The present application obtains original alarm data containing fixed format data and variable format data corresponding to data items from a multi-source monitoring system through the above-mentioned alarm information clustering system, standardizes the variable format data by applying wildcard processing technology, generates wildcard character data, and then merges these data with the fixed format data to form alarm data to be converged. This method improves the consistency and operability of the data, reduces the number of alarms, improves response efficiency, optimizes the stability and security of the network and equipment, thereby enhancing the overall network management and monitoring effects.

[0084] In some optional implementations, step S202 includes the following steps:

[0085] In the first convergence layer, if the wildcard character data corresponding to at least two alarm data to be converged are exactly the same, the at least two alarm data to be converged are converged to obtain converged alarm data; if the wildcard character data corresponding to at least two alarm data to be converged are not exactly the same, the second convergence layer processes them;

[0086] In the second convergence layer, if there is a separator in at least two alarm data to be converged, the alarm data to be converged are segmented according to the separator, and the similarity of the segmented wildcard character part is calculated. If the similarity is greater than the character similarity threshold, the at least two alarm data to be converged are converged to obtain convergence alarm data. If the similarity is less than or equal to the similarity threshold, the third convergence layer is used for processing;

[0087] In the third convergence layer, the similarity of the text contents of the wildcard character data corresponding to at least two alarm data to be converged is calculated. If the similarity is greater than the text similarity threshold, the at least two alarm data to be converged are converged to obtain converged alarm data. If the similarity is less than or equal to the text similarity threshold, the two alarm data to be converged are not converged clustered.

[0088] In this embodiment, the first convergence layer, the second convergence layer, and the third convergence layer can all be used to perform hierarchical convergence clustering processing on the convergence alarm data. It is understandable that the convergence rules between different convergence layers may be different, that is, the convergence alarm data to be converged can be converged clustered according to three different convergence rules.

[0089] In a possible embodiment, the alarm information clustering system performs convergence clustering processing on the alarm data to be converged in turn through different convergence layers. It should be noted that the alarm data to be converged is generally clustered through the first convergence layer first. If the first convergence layer cannot perform clustering, it is clustered according to the second convergence layer, and so on. If the first convergence layer can perform clustering processing, there is no need to perform clustering processing on the second and third convergence layers.

[0090] In another possible embodiment, the alarm information clustering system may perform clustering processing on the type or content of the alarm data to be converged according to the wildcard character data corresponding to the alarm data to be converged.

[0091] Specifically, when the first convergence layer is unable to perform convergence clustering, it enters the second convergence layer. In the above-mentioned second convergence layer, the above-mentioned alarm information clustering system performs character segmentation processing on the alarm data to be converged by the separator contained in the alarm data to be converged, and recognizes the segmented characters after segmentation, and determines the number of identical characters in the alarm data to be converged, and calculates the similarity based on the number. If the similarity is greater than the character similarity threshold, at least two alarm data to be converged are converged to obtain converged alarm data. If the similarity is less than or equal to the similarity threshold, it is processed by the third convergence layer.

[0092] More specifically, when the second convergence layer cannot perform convergence clustering, it enters the third convergence layer. In the above-mentioned third convergence layer, the above-mentioned alarm information clustering system identifies the text of the wildcard characters contained in the alarm data to be converged, and judges whether the wildcard characters corresponding to at least two alarm data to be converged are the same based on the text matching algorithm. If the similarity is greater than the text similarity threshold, at least two alarm data to be converged are converged to obtain converged alarm data. If the similarity is less than or equal to the text similarity threshold, the two alarm data to be converged are not converged clustered.

[0093] This application uses the above-mentioned alarm information clustering system to check the wildcard character data of the alarm data to be converged in the first convergence layer. If the wildcard characters of at least two data are exactly the same, these data will be converged and merged. If they are not the same, the data will be passed to the second convergence layer, the data will be divided by the delimiter and the similarity of the divided wildcard character parts will be calculated. If the similarity exceeds the set character similarity threshold, convergence will be performed, otherwise the data will continue to be passed to the third convergence layer. In the third convergence layer, the above-mentioned alarm information clustering system calculates the similarity of the text content of the wildcard character data of the alarm data to be converged. If the similarity is higher than the text similarity threshold, the data will be converged. If it is lower than or equal to the threshold, no further convergence processing will be performed. This scheme effectively optimizes the management and response of alarm data through hierarchical processing, reduces redundancy, and improves the efficiency and monitoring quality of the system.

[0094] In some optional implementations of this embodiment, before step S203, the following steps are included:

[0095] Determine the wildcard character data features corresponding to the convergence alarm data under the preset layering conditions;

[0096] Based on the wildcard character data feature, a preset convergence template for the current convergence alarm data is determined.

[0097] In an embodiment of the present invention, the wildcard data feature can be used to distinguish the type or content of the convergence alarm data. Generally speaking, the wildcard data feature replaces or abstracts certain characters to create a set pattern or template for matching or data classification. For example, using ? to replace the alarm feature of system abnormality, or using * to replace the alarm feature of system offline, facilitates the subsequent alarm information processing process.

[0098] The above-mentioned preset convergence template is used to guide the system to assign the converged convergence alarm data to the corresponding category list so that the subsequent operation and maintenance personnel can conduct effective monitoring and management. In a possible embodiment, the above-mentioned alarm information clustering system can obtain different wildcard character data by performing convergence clustering on the corresponding wildcard character data features under different preset hierarchical conditions, and construct the convergence template of the current layer based on the obtained wildcard character data, and use it as the preset convergence template of the current convergence alarm data, that is, different convergence layers can have different preset convergence templates, which can be determined according to the rules of hierarchical convergence.

[0099] In the present application, the above-mentioned alarm information clustering system first determines the wildcard character data features of each convergence alarm data under preset hierarchical conditions, which includes extracting key information from the original alarm data and applying wildcards for standardized processing. Then, based on these wildcard character data features, the system selects or defines a preset convergence template suitable for the current data features. These templates are classified according to factors such as the type, severity, and source of the alarm data to ensure that each alarm is processed according to a unified logic. This process not only improves the consistency and predictability of data processing, but also enhances the response efficiency and accuracy of the alarm system, enabling the monitoring system to more effectively manage and respond to various alarm situations.

[0100] In some optional implementations of this embodiment, step S204 includes the following steps:

[0101] Get the wildcard character of the preset convergence template;

[0102] Matching the convergence alarm data based on the wildcard characters of the preset convergence template, and assigning the successfully matched convergence alarm data to the first alarm data list;

[0103] In the first alarm data list, convergence alarm data with the same dimensional granularity is determined and allocated to the second alarm data list.

[0104] In an embodiment of the present invention, in a possible embodiment, the above-mentioned alarm information clustering system obtains the wildcard characters of the corresponding preset convergence template in the current convergence layer and matches them with the convergence alarm data, and calculates the text similarity between the wildcard characters of the preset convergence template and the wildcard characters corresponding to the convergence alarm data. If the similarity is greater than the wildcard similarity threshold, the convergence alarm data is assigned to the first alarm data list. It can be understood that the convergence alarm data in the first alarm data list are all alarm data with the same wildcard characters, that is, the contents of the alarms are the same. For example, the alarm data of system abnormalities are assigned to the first alarm data list.

[0105] In another possible embodiment, the alarm information clustering system matches the corresponding convergence alarm data in the first alarm data list by selecting appropriate dimension granularity, such as time, IP address, etc., and assigns it to the second alarm data list. For example, the alarm data of system abnormality occurring at 11 o'clock is assigned to the second alarm data list.

[0106] The present application obtains wildcard characters from a preset convergence template through the above-mentioned alarm information clustering system, and these characters are used to define the matching rules of the alarm data. The above-mentioned alarm information clustering system uses these wildcard characters to match the convergence alarm data to determine which convergence alarm data conforms to the preset template, and assigns all successfully matched convergence alarm data to the first alarm data list. In the first alarm data list, the above-mentioned alarm information clustering system further filters out the convergence alarm data with the same dimensional granularity, and assigns these data to the second alarm data list. Through precise data matching and classification, the management process of the alarm data is effectively optimized, the processing efficiency is improved, and the accuracy and timeliness of the alarm response are ensured, thereby enhancing the overall monitoring and management capabilities.

[0107] In some optional implementations of this embodiment, the step of matching the convergence alarm data based on the wildcard character of the preset convergence template and assigning the successfully matched convergence alarm data to the first alarm data list further includes the following steps:

[0108] In the first alarm data list, the convergence alarm data with the same intranet IP and extranet IP are clustered to obtain a convergence alarm data cluster;

[0109] In the convergence alarm data cluster, the convergence alarm data with the same alarm time granularity are merged and allocated to the corresponding second alarm data list.

[0110] In an embodiment of the present invention, the above-mentioned convergence alarm data clustering cluster may include convergence alarm data after clustering at the first dimension granularity, wherein the first dimension granularity may select a dimension with content characteristics, such as name, type, etc. This embodiment uses IP for illustration. In this embodiment, the IP can be used to trace the source of the alarm data, that is, the data item of the alarm data can be locked, and the above-mentioned alarm information clustering system can unify the format characteristics of the convergence alarm data through clustering at the first dimension granularity, and determine the data item for issuing the alarm in the first alarm data list, thereby locking the corresponding abnormal service.

[0111] The above-mentioned second alarm data list may include convergence alarm data after second dimension granularity clustering, wherein the second dimension granularity may select a dimension with spatiotemporal characteristics, such as time, address, etc. This embodiment uses time granularity for illustration. In this embodiment, the time granularity can be used to trace the time when the alarm data is generated, that is, to determine when the system abnormality occurs.

[0112] The present application uses the above-mentioned alarm information clustering system to cluster the convergence alarm data in the first alarm data list according to the intranet IP and the extranet IP contained in the convergence alarm data to form different alarm data clustering clusters. This clustering process ensures the consistency of the IP address and ensures that the alarms from the same network environment or device source are effectively grouped. Furthermore, in each alarm data clustering cluster, the above-mentioned alarm information clustering system merges the data with the same alarm time granularity, and the merged data is assigned to the second alarm data list. This solution improves the efficiency of data processing and the responsiveness of the monitoring system, and enhances the manageability and operational effect of the alarm data by reducing redundant alarms.

[0113] In some optional implementations of this embodiment, after the step of determining convergence alarm data with the same dimension granularity in the first alarm data list and allocating them to the second alarm data list, the following steps are also included:

[0114] Acquire new convergence alarm data, and match the wildcard characters of the new convergence alarm data with the wildcard characters of the convergence alarm data in the second alarm data list;

[0115] If the match is successful, the new convergence alarm data is assigned to the corresponding second alarm data list;

[0116] If the match fails, a corresponding new preset convergence template is generated based on the wildcard character corresponding to the new convergence alarm data.

[0117] In an embodiment of the present invention, after acquiring new convergence alarm data, the above-mentioned alarm information clustering system can analyze the new convergence alarm data, obtain the corresponding wildcard character, and match the wildcard character with the wildcard character in the current second alarm data list. Since the wildcard characters in the list are unified, if they match, it means that the alarm content characteristics corresponding to the new alarm data are consistent with those in the current second alarm data list, that is, the new convergence alarm data can be classified. If the match is unsuccessful, it means that the alarm content characteristics corresponding to the new alarm data are inconsistent with those in the current second alarm data list, but they need to be classified. Therefore, based on the wildcard character corresponding to the new convergence alarm data, a new preset convergence template can be generated, and allocated according to the new preset convergence template to obtain a new alarm data list.

[0118] In a possible embodiment, the alarm information clustering system sends the alarm information corresponding to the alarm content characteristics to the operation and maintenance personnel in a unified manner according to the alarm data list, so that the operation and maintenance personnel can perform analysis and monitoring.

[0119] The present application obtains new convergence alarm data through the above-mentioned alarm information clustering system, analyzes its wildcard characters, and matches these wildcard characters with the wildcard characters of the convergence alarm data already existing in the second alarm data list. If the match is successful, the new convergence alarm data will be effectively assigned to the corresponding second alarm data list for further processing and response. If the match is unsuccessful, the alarm information clustering system uses the wildcard character information of the new convergence alarm data to generate a new preset convergence template, which improves the processing efficiency of the alarm data and ensures that the alarm information clustering system can adapt to and respond to new or unforeseen alarm situations. By continuously updating and expanding the convergence template library, the flexibility and adaptability of the overall alarm information clustering system are enhanced.

[0120] It is understandable that in the specific implementation of this application, related data such as alarm data is involved. When the embodiments in this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0121] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned alarm information, the above-mentioned alarm information can also be stored in a node of a blockchain.

[0122] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0123] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application alarm information clustering system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0124] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0125] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0126] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0127] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a device for clustering alarm information, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0128] like Figure 3 As shown, the alarm information clustering device 300 described in this embodiment includes: a first acquisition module 301 , a preprocessing module 302 , a processing module 303 , and a classification module 304 .

[0129] in:

[0130] A first acquisition module 301 is used to acquire original alarm data, where the original alarm data includes an alarm data format;

[0131] A preprocessing module 302, configured to perform format preprocessing on the original alarm data based on the alarm data format to obtain alarm data to be converged;

[0132] The processing module 303 is used to perform hierarchical convergence clustering processing on the to-be-converged alarm data according to a preset hierarchical condition to obtain convergence alarm data;

[0133] The classification module 304 is used to classify the convergence alarm data according to a preset convergence template and dimensional granularity, and determine a corresponding alarm data list.

[0134] In a possible embodiment, the preprocessing module 302 includes:

[0135] A first acquisition submodule is used to acquire fixed format data and variable format data of original alarm data;

[0136] A second acquisition submodule is used to perform wildcard processing on the variable format data to obtain wildcard character data;

[0137] The first determination submodule is used to merge the fixed format data and the corresponding wildcard character data to determine the corresponding alarm data to be converged.

[0138] In a possible embodiment, the processing module 303 includes:

[0139] A first processing submodule is used for, in a first convergence layer, if the wildcard character data corresponding to the at least two alarm data to be converged are exactly the same, converging the at least two alarm data to be converged to obtain converged alarm data; if the wildcard character data corresponding to the at least two alarm data to be converged are not exactly the same, processing them by a second convergence layer;

[0140] A second processing submodule is used for, in the second convergence layer, if there is a separator in the at least two alarm data to be converged, segmenting the alarm data to be converged according to the separator, and performing similarity calculation on the wildcard character parts after segmentation, if the similarity is greater than the character similarity threshold, converging the at least two alarm data to be converged to obtain converged alarm data, and if the similarity is less than or equal to the similarity threshold, processing by the third convergence layer;

[0141] The third processing submodule is used to calculate the similarity of the text contents of the wildcard character data corresponding to the at least two alarm data to be converged in the third convergence layer. If the similarity is greater than the text similarity threshold, the at least two alarm data to be converged are converged to obtain converged alarm data; if the similarity is less than or equal to the text similarity threshold, the two alarm data to be converged are not converged clustered.

[0142] In a possible embodiment, the device further includes:

[0143] A first determination module is used to determine the wildcard character data feature corresponding to the convergence alarm data under a preset layering condition;

[0144] The second determination module is used to determine a preset convergence template of the current convergence alarm data based on the wildcard character data feature.

[0145] In a possible embodiment, the classification module 304 further includes:

[0146] A third acquisition submodule is used to acquire a wildcard character of a preset convergence template;

[0147] A matching submodule, configured to match the convergence alarm data based on the wildcard characters of the preset convergence template, and assign the convergence alarm data that matches successfully to a first alarm data list;

[0148] The second determination submodule is used to determine the convergence alarm data with the same dimensional granularity in the first alarm data list, and allocate it to the second alarm data list.

[0149] In a possible embodiment, the second determining submodule further includes:

[0150] A fourth acquisition submodule is used to cluster the convergence alarm data with the same intranet IP and extranet IP in the first alarm data list to obtain a convergence alarm data cluster;

[0151] The fifth acquisition submodule is used to merge the convergence alarm data with the same alarm time granularity in the convergence alarm data cluster, and distribute them to the corresponding second alarm data list.

[0152] In a possible embodiment, the device further includes:

[0153] A first acquisition module is used to acquire new convergence alarm data, and match the wildcard characters of the new convergence alarm data with the wildcard characters of the convergence alarm data in the second alarm data list;

[0154] A first matching module, configured to assign the new convergence alarm data to a corresponding second alarm data list if the match is successful;

[0155] The second matching module is used to generate a corresponding new preset convergence template based on the wildcard character corresponding to the new convergence alarm data if the matching fails.

[0156] In this embodiment, by obtaining the original alarm data, the original alarm data includes the alarm data format, and based on the alarm data format, the original alarm data is format preprocessed to obtain the alarm data to be converged, ensuring the consistency and standardization of the data, and according to the preset hierarchical conditions, the alarm data to be converged is hierarchically converged and clustered to obtain the converged alarm data, thereby reducing the redundancy of alarm information and improving the pertinence and effectiveness of the alarm. Finally, according to the preset convergence template and dimensional granularity, the converged alarm data is classified to determine the corresponding alarm data list, thereby improving the manageability and response efficiency of the alarm data. The present application performs hierarchical convergence and clustering processing on the original alarm data by preset hierarchical conditions and preprocessing, and classifies the convergence alarm data in combination with the dimensional granularity, thereby improving the efficiency of distinguishing and classifying similar alarm data.

[0157] In this embodiment, the operations performed by the above units or modules correspond one-to-one to the steps of the alarm information clustering method in the above implementation mode, and are not described in detail here.

[0158] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0159] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0160] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0161] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. equipped on the computer device 4. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of the alarm information clustering method, etc. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0162] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run computer-readable instructions stored in the memory 41 or process data, such as computer-readable instructions for running the alarm information clustering method.

[0163] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0164] The present embodiment provides a computer device, which obtains original alarm data, wherein the original alarm data includes an alarm data format, performs format preprocessing on the original alarm data based on the alarm data format, obtains alarm data to be converged, ensures data consistency and standardization, and performs hierarchical convergence clustering processing on the alarm data to be converged according to preset hierarchical conditions to obtain converged alarm data, thereby reducing the redundancy of alarm information and improving the pertinence and effectiveness of alarms. Finally, the convergence alarm data is classified according to a preset convergence template and dimensional granularity, and a corresponding alarm data list is determined, thereby improving the manageability and response efficiency of alarm data. The present application performs hierarchical convergence clustering processing on the original alarm data through preset hierarchical conditions and preprocessing, and classifies the convergence alarm data in combination with dimensional granularity, thereby improving the efficiency of distinguishing and classifying similar alarm data.

[0165] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the alarm information clustering method as described above.

[0166] The present embodiment provides a computer-readable storage medium, which obtains original alarm data, wherein the original alarm data includes an alarm data format, performs format preprocessing on the original alarm data based on the alarm data format, obtains alarm data to be converged, ensures data consistency and standardization, and performs hierarchical convergence clustering processing on the alarm data to be converged according to preset hierarchical conditions to obtain converged alarm data, thereby reducing the redundancy of alarm information and improving the pertinence and effectiveness of alarms. Finally, the convergence alarm data is classified according to a preset convergence template and dimensional granularity, and a corresponding alarm data list is determined, thereby improving the manageability and response efficiency of alarm data. The present application performs hierarchical convergence clustering processing on the original alarm data through preset hierarchical conditions and preprocessing, and classifies the convergence alarm data in combination with dimensional granularity, thereby improving the efficiency of distinguishing and classifying similar alarm data.

[0167] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0168] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A method for clustering alarm information, characterized in that: The steps include: Acquire original alarm data, wherein the original alarm data includes an alarm data format; Based on the alarm data format, performing format preprocessing on the original alarm data to obtain alarm data to be converged; According to preset hierarchical conditions, the to-be-converged alarm data is subjected to hierarchical convergence clustering processing to obtain convergence alarm data; According to the preset convergence template and dimensional granularity, the convergence alarm data is classified to determine the corresponding alarm data list.

2. The alarm information clustering method according to claim 1, characterized in that: The alarm data format includes fixed format data and variable format data. The step of performing format preprocessing on the original alarm data based on the alarm data format to obtain the alarm data to be converged includes: Obtain fixed format data and variable format data of original alarm data; Performing wildcard processing on the variable format data to obtain wildcard character data; The fixed format data and the corresponding wildcard character data are merged to determine the corresponding alarm data to be converged.

3. The alarm information clustering method according to claim 2, characterized in that: The step of performing hierarchical convergence clustering processing on the to-be-converged alarm data according to the preset hierarchical conditions to obtain convergence alarm data comprises: In the first convergence layer, if the wildcard character data corresponding to the at least two alarm data to be converged are exactly the same, the at least two alarm data to be converged are converged to obtain converged alarm data; if the wildcard character data corresponding to the at least two alarm data to be converged are not exactly the same, the second convergence layer processes them; In the second convergence layer, if there is a separator in the at least two alarm data to be converged, the alarm data to be converged is segmented according to the separator, and the similarity of the segmented wildcard character part is calculated. If the similarity is greater than the character similarity threshold, the at least two alarm data to be converged are converged to obtain converged alarm data. If the similarity is less than or equal to the similarity threshold, the third convergence layer is used for processing; In the third convergence layer, the similarity of the text contents of the wildcard character data corresponding to the at least two alarm data to be converged is calculated. If the similarity is greater than the text similarity threshold, the at least two alarm data to be converged are converged to obtain converged alarm data. If the similarity is less than or equal to the text similarity threshold, the two alarm data to be converged are not converged clustered.

4. The alarm information clustering method according to claim 1, characterized in that: Before the convergence alarm data is classified according to the preset convergence template and the dimension granularity and the corresponding alarm data list is determined, the method further includes: Determine the wildcard character data features corresponding to the convergence alarm data under the preset layering conditions; Based on the wildcard character data feature, a preset convergence template for the current convergence alarm data is determined.

5. The alarm information clustering method according to claim 1, characterized in that: The step of classifying the convergence alarm data according to the preset convergence template and the dimension granularity and determining the corresponding alarm data list includes: Get the wildcard character of the preset convergence template; Matching the convergence alarm data based on the wildcard characters of the preset convergence template, and assigning the successfully matched convergence alarm data to the first alarm data list; In the first alarm data list, convergence alarm data with the same dimensional granularity is determined and allocated to the second alarm data list.

6. The alarm information clustering method according to claim 5, characterized in that: The dimension granularity includes an intranet IP, an extranet IP, and an alarm time granularity. The step of determining convergence alarm data with the same dimension granularity in the first alarm data list and allocating it to the second alarm data list includes: In the first alarm data list, the convergence alarm data with the same intranet IP and extranet IP are clustered to obtain a convergence alarm data cluster; In the convergence alarm data cluster, convergence alarm data with the same alarm time granularity are merged and allocated to the corresponding second alarm data list.

7. The alarm information clustering method according to claim 5, characterized in that: After the step of determining the convergence alarm data with the same dimension granularity in the first alarm data list and allocating them to the second alarm data list, the method further includes: Acquire new convergence alarm data, and match the wildcard characters of the new convergence alarm data with the wildcard characters of the convergence alarm data in the second alarm data list; If the match is successful, the new convergence alarm data is assigned to the corresponding second alarm data list; If the match fails, a corresponding new preset convergence template is generated based on the wildcard character corresponding to the new convergence alarm data.

8. An alarm information clustering device, characterized in that: include: A first acquisition module, used to acquire original alarm data, wherein the original alarm data includes an alarm data format; A preprocessing module, configured to perform format preprocessing on the original alarm data based on the alarm data format to obtain alarm data to be converged; A processing module, configured to perform hierarchical convergence clustering processing on the to-be-converged alarm data according to a preset hierarchical condition to obtain convergence alarm data; The classification module is used to classify the convergence alarm data according to a preset convergence template and dimensional granularity, and determine a corresponding alarm data list.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the alarm information clustering method according to any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the alarm information clustering method according to any one of claims 1 to 7 are implemented.

Images