Alarm management method and device, equipment and storage medium

Abstract

The invention provides an alarm management method which can be applied to the technical field of information security. The alarm management method comprises the steps that access data and alarm information of a first time period are received, the access data and the alarm information aim at M alarm nodes, and M is a positive integer; establishing a directed graph based on the access data and the alarm information, wherein the directed graph is a directed graph of M alarm nodes; special nodes in M alarm nodes of the directed graph are selected, the special nodes comprise K types, and K is a positive integer; and processing the special node according to a preset processing logic, wherein the preset processing logic comprises sub-logics in one-to-one correspondence with the K types. The invention further provides an alarm management device, equipment and a storage medium.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to an alarm management method, device, equipment and storage medium. Background Art

[0002] Enterprises monitor and handle events in production and disaster recovery environments by establishing centralized monitoring and alarm systems and event management platforms. The centralized monitoring and alarm system collects equipment alarm information through Syslog and Trap protocols, and summarizes and presents it in a unified manner. Alarm information usually includes elements such as the time of occurrence, alarm description, and level. Among them, fault alarms must be managed as production events after they occur, and the monitoring personnel must create an event ticket within a specified time and notify the relevant operation and maintenance personnel. Under normal circumstances, monitoring personnel need to rely on experience to first verify which alarm information needs to be merged and created on the monitoring and alarm system, and then log in to the event management platform to create new event tickets in turn. For alarm information that has a serious impact on external services, business, and customer-sensitive systems, the monitoring personnel must also immediately notify the business department to conduct joint emergency response. After all events have been handled, the monitoring personnel must manually confirm the elimination of the alarm within a specified time, and close the alarm information in turn to archive the alarm information.

[0003] In the actual production operation monitoring process, due to the large number and high repetitiveness of various alarm information, it may cause the alarm information to accumulate, untimely processing, and affect the operation and maintenance timeliness. Summary of the invention

[0004] In view of the above problems, the present disclosure provides an alarm management method, apparatus, device and storage medium for improving the timeliness of operation and maintenance.

[0005] According to the first aspect of the present disclosure, there is provided an alarm management method, comprising: receiving access data and alarm information of a first time period, wherein the access data and alarm information are for M alarm nodes, and M is a positive integer; establishing a directed graph based on the access data and the alarm information, and the directed graph is a directed graph of the M alarm nodes; selecting a special node from the M alarm nodes of the directed graph, and the special node includes K categories, and K is a positive integer; and handling the special node according to a preset handling logic, and the preset handling logic includes sub-logics corresponding one-to-one to the K categories.

[0006] According to an embodiment of the present disclosure, the establishment of a directed graph based on the access data and the alarm information includes: establishing an access relationship between the M alarm nodes based on the access data and the alarm information, wherein the alarm information includes an alarm order; and based on the alarm order, using a deep traversal algorithm, calculating the standard directed degrees of the M alarm nodes through the access relationship.

[0007] According to an embodiment of the present disclosure, the access relationship between the M alarm nodes is established based on the access data and the alarm information, including: determining the access relationship between the M alarm nodes according to the alarm order, wherein, for any alarm node, determining an outgoing edge and an incoming edge, wherein, for the outgoing edge, when an adjacent alarm node of the current alarm node satisfies an outgoing edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the outgoing edge, and the outgoing edge rule includes: the adjacent alarm node has visited the current alarm node, or the adjacent alarm node is the front-end node of the current alarm node; for the incoming edge, when an adjacent alarm node of the current alarm node satisfies an ingoing edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the incoming edge, and the ingoing edge rule includes: the current alarm node has visited the adjacent alarm node, or the adjacent alarm node is the back-end node of the current alarm node.

[0008] According to an embodiment of the present disclosure, based on the alarm order, a depth traversal algorithm is used to calculate the standard directional degrees of the M alarm nodes through the access relationship, including: for any alarm node, based on the current alarm node as the starting point, visiting the adjacent alarm nodes of the current alarm node until all the adjacent alarm nodes of the alarm node are visited; calculating the standard directional degrees from the alarm node to all adjacent alarm nodes; and when all the adjacent alarm nodes of the current alarm node have been visited, taking the last visited adjacent alarm node as the next alarm node.

[0009] According to an embodiment of the present disclosure, the step of calculating the standard directional degree from the alarm node to all adjacent alarm nodes includes: calculating the directed edge risk assignment of the alarm node; and calculating the standard directional degree of the alarm node based on the directed edge risk assignment.

[0010] According to an embodiment of the present disclosure, wherein the alarm node includes an alarm node risk assignment, the calculation of the directed edge risk assignment of the alarm node includes: summing the alarm node risk assignment of the current alarm node and the alarm node risk assignment of the adjacent alarm nodes to obtain the directed edge risk assignment from the current alarm node to the adjacent alarm node.

[0011] According to an embodiment of the present disclosure, the step of calculating the standard directional degree of the alarm node based on the directed edge risk assignment includes: calculating the standard directional degree based on all directed edge risk assignments of the current alarm node.

[0012] According to an embodiment of the present disclosure, wherein the standard directed degree includes the standard directed degree of the outgoing edge and the standard directed degree of the incoming edge, the selecting of the special node among the M alarm nodes of the directed graph includes: selecting the alarm node with the largest standard directed degree of the outgoing edge among the M alarm nodes as the key fault node; and selecting the alarm node with the largest standard directed degree of the incoming edge among the M alarm nodes as the node most seriously affected.

[0013] According to an embodiment of the present disclosure, the special node is handled according to a preset handling logic, and the preset handling logic includes sub-logics corresponding one-to-one to the K categories, including: generating an emergency handling instruction for the most severely affected node, and the emergency handling instruction is used to notify relevant responsible persons to handle the most severely affected node; for the key fault node, establishing an event sheet involving the key fault node, and the event sheet is used to continuously monitor the key fault node involved in the event sheet.

[0014] According to an embodiment of the present disclosure, the method further includes: receiving alarm information of a second time period; judging whether the directed graph generated in the first time period in the second time period is valid; and in the case that the directed graph generated in the first time period is valid, using the directed graph generated in the first time period, wherein the judging method includes: judging whether the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period; and in the case that the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period, using the directed graph generated in the first time period.

[0015] The second aspect of the present disclosure provides an alarm management device, including: a receiving module, used to receive access data and alarm information of a first time period, wherein the access data and alarm information are for M alarm nodes, and M is a positive integer; a directed graph establishment module, used to establish a directed graph based on the access data and the alarm information, and the directed graph is a directed graph of M alarm nodes; a special node selection module, used to select special nodes from the M alarm nodes of the directed graph, and the special nodes include K categories, and K is a positive integer; and a handling module, used to handle the special nodes according to a preset handling logic, and the preset handling logic includes sub-logics corresponding one-to-one to the K categories.

[0016] According to an embodiment of the present disclosure, the directed graph establishment module includes an access relationship establishment unit and a depth traversal unit, wherein the access relationship establishment unit is used to establish an access relationship between the M alarm nodes based on the access data and the alarm information, wherein the alarm information includes an alarm order; and the depth traversal unit is used to calculate the standard directed degrees of the M alarm nodes through the access relationship based on the alarm order and using a depth traversal algorithm.

[0017] According to an embodiment of the present disclosure, the access relationship establishing unit includes an access relationship establishing sub-unit, and the access relationship establishing sub-unit is used to determine the access relationship between the M alarm nodes according to the alarm order, wherein, for any alarm node, an outgoing edge and an incoming edge are determined, wherein, for the outgoing edge, when the adjacent alarm node of the current alarm node satisfies the outgoing edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the outgoing edge, and the outgoing edge rule includes: the adjacent alarm node has visited the current alarm node, or the adjacent alarm node is the front-end node of the current alarm node; for the incoming edge, when the adjacent alarm node of the current alarm node satisfies the ingoing edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the incoming edge, and the ingoing edge rule includes: the current alarm node has visited the adjacent alarm node, or the adjacent alarm node is the back-end node of the current alarm node.

[0018] According to an embodiment of the present disclosure, the depth traversal unit includes an access subunit and a standard degree calculation subunit. The access subunit is used to, for any alarm node, access the adjacent alarm nodes of the current alarm node based on the current alarm node as the starting point until all the adjacent alarm nodes of the alarm node are visited; the standard degree calculation subunit is used to calculate the standard directional degree from the alarm node to all adjacent alarm nodes; and the access subunit is also used to take the last visited adjacent alarm node as the next alarm node when all the adjacent alarm nodes of the current alarm node have been visited.

[0019] According to an embodiment of the present disclosure, the standard degree calculation subunit is further used to calculate the directed edge risk assignment of the alarm node; and based on the directed edge risk assignment, calculate the standard directed degree of the alarm node.

[0020] According to an embodiment of the present disclosure, wherein the alarm node includes an alarm node risk assignment, the standard degree calculation subunit is also used to obtain the directed edge risk assignment from the current alarm node to the adjacent alarm node based on the sum of the alarm node risk assignment of the current alarm node and the alarm node risk assignment of the adjacent alarm node.

[0021] According to an embodiment of the present disclosure, the standard degree calculation subunit is further used to calculate the standard directed degree based on all directed edge risk assignments of the current alarm node.

[0022] According to an embodiment of the present disclosure, the standard directional degree includes the standard directional degree of the outgoing edge and the standard directional degree of the incoming edge, and the special node selection module includes a key fault node selection unit and a most severely affected node selection unit, the key fault node selection unit is used to select the alarm node with the largest standard directional degree of the outgoing edge among the M alarm nodes as the key fault node; and the standard directional degree of the incoming edge is used to select the alarm node with the largest standard directional degree of the incoming edge among the M alarm nodes as the most severely affected node.

[0023] According to an embodiment of the present disclosure, the handling module includes a first handling unit and a second handling unit, wherein the first handling unit is used to generate an emergency handling instruction for the most severely affected node, and the emergency handling instruction is used to notify relevant responsible persons to handle the most severely affected node; the second handling unit is used to establish an event sheet involving the key fault node for the key fault node, and the event sheet is used to continuously monitor the key fault node involved in the event sheet.

[0024] According to an embodiment of the present disclosure, the device further includes: an alarm information judgment module and a directed graph use module, the receiving module is also used to receive alarm information of a second time period; the alarm information judgment module is used to judge whether the directed graph generated in the first time period is valid in the second time period; and the directed graph use module is used to use the directed graph generated in the first time period if the directed graph generated in the first time period is valid, wherein the judgment method includes: judging whether the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period; and if the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period, then using the directed graph generated in the first time period.

[0025] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned alarm management method.

[0026] The fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned alarm management method.

[0027] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above-mentioned alarm management method when executed by a processor.

[0028] In the embodiments of the present disclosure, in order to solve the technical problem of complicated system alarm information and low processing efficiency, a directed graph is output by combining access data and alarm information to show the correlation between alarm devices, effectively sorting out and screening alarm nodes with high correlation; then, several special types of nodes among these alarm nodes are selected and processed according to corresponding disposal methods to achieve differential processing, effectively ensuring that important alarms can be processed in a timely manner and ensuring the overall operation and maintenance efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0030] Figure 1 The application scenario diagram of the alarm management method according to the embodiment of the present disclosure is schematically shown;

[0031] Figure 2 A flowchart of an alarm management method according to an embodiment of the present disclosure is schematically shown;

[0032] Figure 3 A flowchart of a directed graph creation method according to an embodiment of the present disclosure is schematically shown;

[0033] Figure 4 A flowchart of a depth traversal method according to an embodiment of the present disclosure is schematically shown;

[0034] Figure 5 A flowchart of a standard directional calculation method according to an embodiment of the present disclosure is schematically shown;

[0035] Figure 6 A flowchart of a special node selection method according to an embodiment of the present disclosure is schematically shown;

[0036] Figure 7 A flowchart of a special node handling method according to an embodiment of the present disclosure is schematically shown;

[0037] Figure 8 A flowchart schematically shows another alarm management method according to an embodiment of the present disclosure;

[0038] Fig. 9 A schematic diagram of a directed graph according to an embodiment of the present disclosure is schematically shown;

[0039] Fig.10 A schematic diagram schematically shows another directed graph according to an embodiment of the present disclosure;

[0040] Fig.11 A schematic diagram of a structure of an alarm management device according to an embodiment of the present disclosure is shown; and

[0041] Fig.12 A block diagram of an electronic device suitable for implementing an alarm management method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0042] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0043] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0044] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0045] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0046] Before the embodiments of the present disclosure are disclosed in detail, the key technical terms in the embodiments of the present disclosure are explained one by one, as follows:

[0047] Centrality algorithms: Centrality algorithms are used to understand the role of specific nodes in a graph and their impact on the network. These algorithms can help us understand group dynamics such as trustworthiness, accessibility, how quickly events spread, and “bridges” between groups.

[0048] Degree centrality algorithm: can be used as a benchmark indicator of connectivity. It measures the number of out-degree and in-degree of a node. Nodes with high degrees can provide feedback on the popularity of a node.

[0049] In order to solve the technical problems existing in the prior art, an embodiment of the present disclosure provides an alarm management method, receiving access data and alarm information of a first time period, wherein the access data and alarm information are for M alarm nodes, and M is a positive integer; establishing a directed graph based on the access data and the alarm information, and the directed graph is a directed graph of M alarm nodes; selecting a special node from the M alarm nodes of the directed graph, and the special node includes K categories, and K is a positive integer; and handling the special node according to a preset handling logic, and the preset handling logic includes sub-logics corresponding one-to-one to the K categories.

[0050] In the embodiments of the present disclosure, in order to solve the technical problem of complicated system alarm information and low processing efficiency, a directed graph is output by combining access data and alarm information to show the correlation between alarm devices, effectively sorting out and screening alarm nodes with high correlation; then, several special types of nodes among these alarm nodes are selected and processed according to corresponding disposal methods to achieve differential processing, effectively ensuring that important alarms can be processed in a timely manner and ensuring the overall operation and maintenance efficiency of the system.

[0051] Figure 1 The application scenario diagram of the alarm management method according to the embodiment of the present disclosure is schematically shown.

[0052] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0053] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0054] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0055] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0056] It should be noted that the alarm management method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the alarm management device provided in the embodiment of the present disclosure can generally be set in the server 105. The alarm management method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the alarm management device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0057] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0058] The following will be based on Figure 1 The scene described by Figure 2 to Figure 10 The alarm management method of the disclosed embodiment is described in detail.

[0059] Figure 2 The flowchart of the alarm management method according to the embodiment of the present disclosure is schematically shown.

[0060] like Figure 2 As shown, the alarm management method of this embodiment includes operations S210 to S240, and the method can be executed by the server 105.

[0061] In operation S210, access data and alarm information of a first time period are received, wherein the access data and alarm information are for M alarm nodes, where M is a positive integer.

[0062] The access data mentioned above includes network traffic logs and application node information in the configuration management system, and one alarm node corresponds to one or more hardware devices.

[0063] It should be noted that the embodiments of the present disclosure are applicable to various types of monitoring alarm information, including common monitoring scenarios such as applications, databases, and security.

[0064] Specifically, in the T time period, alarm information, network traffic logs, and application node information in the configuration management system (or configuration management data) are received, and the alarm information, network traffic logs, and application node information in the configuration management system are preprocessed by data cleaning and standardization to retain key fields for subsequent analysis. Among them, for network traffic logs and configuration management data, as shown in Table 1 and Table 2 below:

[0065]

[0066] Table 1

[0067]

[0068] Table 2

[0069] Among them, the network traffic log contains temporary access relationships between nodes, and the configuration management data reflects the fixed access relationships between application nodes.

[0070] In operation S220, a directed graph is established based on the access data and the alarm information, where the directed graph is a directed graph of M alarm nodes.

[0071] Specifically, the networkx library of Python can be used to select the device nodes that generate alarm information during the T period and draw a directed graph.

[0072] In operation S230, a special node is selected from the M alarm nodes of the directed graph, where the special node includes K types, where K is a positive integer.

[0073] In operation S240, the special node is handled according to a preset handling logic, where the preset handling logic includes sub-logics corresponding to the K categories one by one.

[0074] Specifically, special nodes with higher urgency and criticality are selected from these alarm nodes. Special nodes are also divided into multiple categories. Different categories reflect different urgency and criticality. Different processing logics are used to process node devices corresponding to the alarm information for different categories.

[0075] It can be understood that the embodiments of the present disclosure are intended to use network traffic logs and application configuration management information to determine the correlation of monitoring alarm devices, realize automatic centralized processing of alarm information, and help improve the timeliness and convenience of monitoring implementation personnel in handling alarm information and production events.

[0076] In the embodiments of the present disclosure, in order to solve the technical problem of complicated system alarm information and low processing efficiency, a directed graph is output by combining access data and alarm information to show the correlation between alarm devices, effectively sorting out and screening alarm nodes with high correlation; then, several special types of nodes among these alarm nodes are selected and processed according to corresponding disposal methods to achieve differential processing, effectively ensuring that important alarms can be processed in a timely manner and ensuring the overall operation and maintenance efficiency of the system.

[0077] Next, the method for establishing a directed graph according to the embodiment of the present disclosure will be disclosed in detail, as shown below:

[0078] Figure 3 The flowchart of the directed graph establishment method according to the embodiment of the present disclosure is schematically shown.

[0079] like Figure 3 As shown, the directed graph establishing method of this embodiment includes operations S310 to S320, and operations S310 to S320 can at least partially execute the above-mentioned operation S220.

[0080] In operation S310, an access relationship between the M alarm nodes is established based on the access data and the alarm information, wherein the alarm information includes an alarm sequence.

[0081] Specifically, the access relationship is the access relationship between different alarm nodes. Taking an alarm node A among M alarm nodes as an example, the access relationship of the alarm node A includes an outbound direction and an inbound direction. The outbound direction is from the alarm node A to other alarm nodes, and the inbound direction is from other alarm nodes to alarm node A.

[0082] According to an embodiment of the present disclosure, the access relationship between the M alarm nodes is established based on the access data and the alarm information, including: determining the access relationship between the M alarm nodes according to the alarm order, wherein, for any alarm node, determining an outgoing edge and an incoming edge, wherein, for the outgoing edge, when an adjacent alarm node of the current alarm node satisfies an outgoing edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the outgoing edge, and the outgoing edge rule includes: the adjacent alarm node has visited the current alarm node, or the adjacent alarm node is the front-end node of the current alarm node; for the incoming edge, when an adjacent alarm node of the current alarm node satisfies an ingoing edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the incoming edge, and the ingoing edge rule includes: the current alarm node has visited the adjacent alarm node, or the adjacent alarm node is the back-end node of the current alarm node.

[0083] For example, for the outbound branch: sort by time, select the first device node that generates a monitoring alarm as V1, and create a new outbound vertex V if the following two conditions are met i , mark the event summary and IP, and go from vertex V1 to vertex V i Draw a directed line segment E 1i Condition 1: Query in the network traffic log, if V i During this period, V1 was accessed, or V i It is the front-end node of V1, that is, V1 to V i Provide data. Condition 2: V i There is an alarm message.

[0084] For another example, for an incoming branch: if the following two conditions are met, a new outgoing vertex V is created. j , mark the event summary and IP, and from the vertex V j Draw a directed line segment E to vertex V1 j1 Condition 1: Query the network traffic log and find that if V1 has visited V during this period j , or in the configuration information table V j It is the backend node of V1, namely V j Provide data to V1. Condition 2: V j There is an alarm message.

[0085] In operation S320, based on the alarm sequence, a depth traversal algorithm is used to calculate the standard directional degrees of the M alarm nodes through the access relationship.

[0086] Specifically, the deep traversal algorithm follows the depth-first traversal, by selecting an unvisited vertex as the starting vertex and marking it as having been visited; then searching all other adjacent vertices of the vertex to determine whether these vertices have been visited. If not, a vertex is selected to continue visiting, and the previous steps are repeated until all adjacent vertices of a vertex have been visited. In this case, after falling back to the vertex where there are unvisited adjacent vertices, the deep traversal access is continued until all nodes are visited.

[0087] For example, according to the depth traversal algorithm, select a vertex V adjacent to V1 x Visit and calculate its standard directional degree at the same time. x Repeat the above operation. If all adjacent vertices of the currently visited vertex have been visited, return to the last V in the visited vertex sequence that has unvisited adjacent vertices. y , from V v Start traversing according to the above method until all vertices in the graph have been visited and the standard directed degree of each vertex is obtained.

[0088] Each event alarm information in the T period is traversed in turn, and the above operations S310 to S320 are repeated to draw all vertices and directed line segments to form a directed graph of alarm nodes.

[0089] Of course, in the process of accessing vertices (or nodes), it is also necessary to calculate some parameter values ​​of the vertices. The parameter values ​​can effectively measure whether the alarm node is a special node. The deep traversal method is as follows:

[0090] Figure 4 The flowchart of the depth traversal method according to the embodiment of the present disclosure is schematically shown.

[0091] like Figure 4 As shown, the depth traversal method of this embodiment includes operations S410 to S430, and operations S410 to S430 can at least partially execute the above-mentioned operation S320.

[0092] In operation S410, for any alarm node, based on the current alarm node as a starting point, the adjacent alarm nodes of the current alarm node are visited until all the adjacent alarm nodes of the alarm node are visited.

[0093] The starting point is an alarm node based on the current alarm node, and the adjacent alarm nodes are accessed in the incoming direction and the adjacent alarm nodes are accessed in the outgoing direction.

[0094] Specifically, the current alarm node refers to the node that is used as the benchmark to access the adjacent alarm nodes of the node. During this process, it includes access in the incoming direction as well as access in the outgoing direction. For the alarm node that serves as the benchmark, all its adjacent nodes need to be fully visited before the access logic of the adjacent alarm nodes of the next alarm node that serves as the benchmark can be enabled.

[0095] In operation S420, the standard directional degrees from the alarm node to all adjacent alarm nodes are calculated.

[0096] Specifically, the standard directed degree has a direction, and measures the importance of the alarm node with other alarm nodes in the directed graph under the outbound and inbound access relationships.

[0097] Figure 5 The flowchart of the standard directional calculation method according to the embodiment of the present disclosure is schematically shown.

[0098] like Figure 5 As shown, the standard directional calculation method of this embodiment includes operations S510 to S520, and operations S510 to S520 can at least partially execute the above operation S420.

[0099] In operation S510 , the directed edge risk assignment of the alarm node is calculated.

[0100] According to an embodiment of the present disclosure, wherein the alarm node includes an alarm node risk assignment, the calculation of the directed edge risk assignment of the alarm node includes: for any alarm node, summing the alarm node risk assignment of the current alarm node and the alarm node risk assignment of the adjacent alarm node to obtain the directed edge risk assignment from the current alarm node to the adjacent alarm node.

[0101] Specifically, the level of monitoring alarm is proportional to the risk value (denoted as S). The risk value for a certain alarm node is pre-set, and what needs to be calculated is the wind direction value of the directed edge between the alarm node and its adjacent alarm nodes. i The risk value of is the risk value corresponding to the highest alarm level at the node, and the vertex is marked as S i , it is necessary to combine the risk assignments of different adjacent alarm nodes to realize the directed edge risk assignment calculation.

[0102] For example, to calculate the risk of directed edges: Starting from vertex V1, calculate the directed edge E 1i The risk assignment of the incoming edge E j1 The risk value of outgoing edge E 1i The calculation method of the risk assignment is as follows: j1 The risk assignment is shown in Formula 2:

[0103] S 1i =S1+S i Formula 1

[0104] S j1 =S1+S j Formula 2

[0105] In operation S520, based on the directed edge risk assignment, a standard directed degree of the alarm node is calculated.

[0106] According to an embodiment of the present disclosure, the step of calculating the standard directional degree of an alarm node based on the directed edge risk assignments includes: for any alarm node, calculating the standard directional degree based on all directed edge risk assignments of the current alarm node.

[0107] Specifically, based on the outgoing edge risk assignment and the incoming edge risk assignment obtained above, the standard oriented degree of the outgoing edge and the standard oriented degree of the incoming edge are calculated respectively, and the standard oriented degrees of the edges in different directions are obtained by accumulating the risk assignments of the corresponding directions and calculating the average value.

[0108] For example, to calculate the standard outgoing degree of a vertex: Starting from vertex V1, calculate the standard outgoing degree C of vertex V1 1出Similarly, calculate the standard in-direction C of vertex V1 1入 Among them, the standard outgoing degree C 1出 The calculation method is as shown in the following formula 3, the standard incidence C 1入 The calculation method of is shown in the following formula 4:

[0109] C 1出 =∑s 1i / N 1出 Formula 3

[0110] C 1入 =∑s j1 / N 1入 Formula 4

[0111] Among them, S li It means starting from vertex V1 and pointing to vertex V i The risk value of the directed edge, N1out represents the number of outgoing branches from vertex V1.

[0112] In operation S430, when all the adjacent alarm nodes of the current alarm node have been visited, the last visited adjacent alarm node is used as the next alarm node.

[0113] That is, the standard directional calculation of the alarm node in the next round starts from the last visited node in this round.

[0114] Figure 6 The flowchart of the special node selection method according to the embodiment of the present disclosure is schematically shown.

[0115] like Figure 6 As shown, the special node selection method of this embodiment includes operations S610 to S620, and operations S610 to S620 can at least partially execute the above-mentioned operation S230.

[0116] According to an embodiment of the present disclosure, the standard directional dimensions include standard directional dimensions of outgoing edges and standard directional dimensions of incoming edges.

[0117] In operation S610, an alarm node with the largest outgoing edge standard direction among the M alarm nodes is selected as a key fault node.

[0118] In operation S620, the alarm node with the largest standard directional degree of the incoming edge among the M alarm nodes is selected as the node most seriously affected.

[0119] For example, the output standard has the largest oriented vertex and its label as shown in Table 3 below:

[0120] Table 3

[0121] Among them, the highest alarm level of the outgoing edge is level 4, and the corresponding centrality is 6.5, so the corresponding alarm node is selected as the key fault node. The highest alarm level of the incoming edge is 6, and the corresponding centrality is 6.3, so the corresponding alarm node is selected as the most affected node.

[0122] Figure 7 The flowchart of the special node handling method according to the embodiment of the present disclosure is schematically shown.

[0123] like Figure 7 As shown, the special node handling method of this embodiment includes operations S710 to S720, and operations S710 to S720 can at least partially execute the above-mentioned operation S240.

[0124] In operation S710, an emergency handling instruction is generated for the most severely affected node, and the emergency handling instruction is used to notify relevant responsible persons to handle the most severely affected node. Specifically, according to the applications deployed on the most severely affected node, relevant business departments are notified to pay close attention and cooperate with the emergency.

[0125] In operation S720, an event sheet involving the key fault node is established for the key fault node, and the event sheet is used to continuously monitor the key fault node involved in the event sheet.

[0126] Specifically, implement troubleshooting monitoring on key fault nodes. After the event list is established, execute this step. After each node fault is eliminated, the alarm information on it will no longer be prompted or added. After all monitoring alarms of the node in the directed graph in the T period are stopped, the vertex corresponding to the node in the directed graph is grayed out. After the event list is established, use the depth-first algorithm to loop through all vertices in the graph to check whether they can be grayed out. After all vertices in the graph are grayed out, the associated event list can be confirmed to be closed.

[0127] For example, the application and person in charge of the device are used as the leading application and person in charge of the event, and the applications and persons in charge corresponding to other vertices in the graph are handled collaboratively. All monitoring alarm information in the directed graph is associated with this event sheet, so as to realize the aggregation of alarm information and share the event sheet. The risk level of the event can be determined according to the highest alarm level of the key node. According to the output of the most seriously affected node (as shown in Table 3 above), the relevant business departments are notified to pay close attention to the business impact caused by the application on this node and take business emergency measures. If multiple events are found to have a correlation during the troubleshooting process, multiple event sheets can be linked to establish a total-to-split relationship. According to the monitoring results of troubleshooting, the event sheet is closed in two situations. One is that if it ends within the emergency time, the event management platform is linked to automatically close the corresponding event sheet, and the corresponding monitoring alarm information is automatically closed and archived; the other is that if the monitoring alarm is not automatically closed after the emergency processing time or close to the emergency processing time cutoff, the monitoring personnel are prompted to pay attention to the event processing. For event sheets with a total-to-split relationship, the total event sheet is closed after all the sub-event sheets are closed.

[0128] It is understandable that the efficiency of monitoring and alarm management is improved by setting up event sheets. In the daily monitoring and alarm management process, the operation and maintenance personnel log in to the monitoring and alarm system to view each piece of information, manually determine whether an event sheet needs to be established, and which monitoring alarms can be combined to establish an event sheet. After the event processing is completed, the corresponding monitoring alarm message needs to be manually closed and archived. Automatic aggregation of alarm messages to create event sheets, close event sheets, and archive alarm information is realized. At the same time, it can also promptly remind monitoring personnel to pay attention to alarm messages and corresponding events that have not been handled in time, greatly improving the efficiency of monitoring and alarm processing.

[0129] Figure 8 A flowchart of another alarm management method according to an embodiment of the present disclosure is schematically shown.

[0130] like Figure 8 As shown, another alarm management method of this embodiment includes operations S810 to S830, and operations S810 to S830 are performed after operation S240.

[0131] In operation S810, alarm information of a second time period is received.

[0132] In operation S820, determine whether the directed graph generated in the first time period is valid in the second time period, wherein the determination method includes: determining whether the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period; and if the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period, then using the directed graph generated in the first time period.

[0133] In operation S830, if the directed graph generated in the first time period is valid, the directed graph generated in the first time period is used.

[0134] Specifically, the second time period is after the first time period, and the second time period and the first time period can be continuous or discontinuous. After receiving an alarm in a future time period, if the alarm information indicates that everything is consistent with the first time period, the directed graph generated in the first time period is used to reduce the calculation cost.

[0135] For example, if the directed graph established in the T period is still in effect, that is, the nodes corresponding to the vertices in the graph still have alarm information that has not been closed, the alarm information generated in the T+N period is processed according to the following rules: if the device and alarm information that generated the alarm are exactly the same as those in the T period, no new mapping will be added, and the directed graph of the T period will be used; for other conditions, new mapping will be added. The mapping rules for the second time period are shown in Table 4 below:

[0136]

[0137]

[0138] Table 4

[0139] Among them, as shown in Table 4, only when the device generating the alarm and the alarm information content are exactly the same as those in period T, the directed graph of period T is used. In the cases where "the device generating the alarm is the same as the device in period T, and the alarm information on it is different from the alarm in period T", "the device generating the alarm is different from the device in period T, but it interacts with the device generating the alarm in period T", and "the device generating the alarm has no interaction with the device in period T", a new directed graph needs to be added / created.

[0140] Fig. 9 A schematic diagram of a directed graph according to an embodiment of the present disclosure is schematically shown.

[0141] like Fig. 9 As shown, there are 6 alarm nodes in the first time period, and the relationship between these alarm nodes is V1 points to V2, V2 points to V3 and V4, V5 points to V4 and V6, and V6 points to V4. Among them, the risk value of V1 is 2, the risk value of V2 is 4, the risk value of V3 is 1, the risk value of V4 is 3, the risk value of V5 is 4, and the risk value of V6 is 2.

[0142] Fig.10 A schematic diagram of another directed graph according to an embodiment of the present disclosure is schematically shown.

[0143] like Fig.10 As shown, after the above-mentioned logical processing based on the calculation of the inbound standard degree and the outbound standard degree, C is obtained.出max V5 Vertex and C for 6.5 入max The V4 node with a value of 6.3, the vertex with the largest outgoing degree is the key fault node, and the vertex with the largest incoming degree is the most severely affected node, that is, V5 is the key fault node, and V4 is the most severely affected node. Different processing logics are adopted for these two types of nodes. Identifying V5 and V4 in the figure helps monitoring and operation and maintenance personnel to more intuitively understand the occurrence and handling of faults and risk elimination, thereby improving user experience.

[0144] Based on the above alarm management method, the present disclosure also provides an alarm management device. Fig.11 The device is described in detail.

[0145] Fig.11 The structural block diagram of the alarm management device according to an embodiment of the present disclosure is schematically shown.

[0146] like Fig.11 As shown, the alarm management device 1100 of this embodiment includes a receiving module 1110, a directed graph building module 1120, a special node selection module 1130 and a handling module 1140.

[0147] The receiving module 1110 is used to receive access data and alarm information in a first time period, wherein the access data and alarm information are for M alarm nodes, where M is a positive integer. In one embodiment, the receiving module 1110 can be used to perform the operation S210 described above, which will not be described in detail here.

[0148] The directed graph establishment module 1120 is used to establish a directed graph based on the access data and the alarm information, and the directed graph is a directed graph of M alarm nodes. In one embodiment, the directed graph establishment module 1120 can be used to perform the operation S220 described above, which will not be described in detail here.

[0149] The special node selection module 1130 is used to select a special node from the M alarm nodes of the directed graph, wherein the special node includes K types, where K is a positive integer. In one embodiment, the special node selection module 1130 can be used to perform the operation S230 described above, which will not be described in detail here.

[0150] The handling module 1140 is used to handle the special node according to a preset handling logic, and the preset handling logic includes sub-logics corresponding to the K categories one by one. In one embodiment, the handling module 1140 can be used to perform the operation S240 described above, which will not be repeated here.

[0151] In the embodiments of the present disclosure, in order to solve the technical problem of complicated system alarm information and low processing efficiency, a directed graph is output by combining access data and alarm information to show the correlation between alarm devices, effectively sorting out and screening alarm nodes with high correlation; then, several special types of nodes among these alarm nodes are selected and processed according to corresponding disposal methods to achieve differential processing, effectively ensuring that important alarms can be processed in a timely manner and ensuring the overall operation and maintenance efficiency of the system.

[0152] According to an embodiment of the present disclosure, the directed graph establishment module includes an access relationship establishment unit and a depth traversal unit, wherein the access relationship establishment unit is used to establish an access relationship between the M alarm nodes based on the access data and the alarm information, wherein the alarm information includes an alarm order; and the depth traversal unit is used to calculate the standard directed degrees of the M alarm nodes through the access relationship based on the alarm order and using a depth traversal algorithm.

[0153] According to an embodiment of the present disclosure, the access relationship establishing unit includes an access relationship establishing sub-unit, and the access relationship establishing sub-unit is used to determine the access relationship between the M alarm nodes according to the alarm order, wherein, for any alarm node, an outgoing edge and an incoming edge are determined, wherein, for the outgoing edge, when the adjacent alarm node of the current alarm node satisfies the outgoing edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the outgoing edge, and the outgoing edge rule includes: the adjacent alarm node has visited the current alarm node, or the adjacent alarm node is the front-end node of the current alarm node; for the incoming edge, when the adjacent alarm node of the current alarm node satisfies the ingoing edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the incoming edge, and the ingoing edge rule includes: the current alarm node has visited the adjacent alarm node, or the adjacent alarm node is the back-end node of the current alarm node.

[0154] According to an embodiment of the present disclosure, the depth traversal unit includes an access subunit and a standard degree calculation subunit. The access subunit is used to access the adjacent alarm nodes of the current alarm node based on the current alarm node as the starting point for any alarm node until all the adjacent alarm nodes of the alarm node are visited; the standard degree calculation subunit is used to calculate the standard directed degree from the alarm node to all adjacent alarm nodes; and the access subunit is also used to use the last adjacent alarm node to be visited as the next alarm node when all the adjacent alarm nodes of the current alarm node have been visited.

[0155] According to an embodiment of the present disclosure, the standard degree calculation subunit is further used to calculate the directed edge risk assignment of the alarm node; and based on the directed edge risk assignment, calculate the standard directed degree of the alarm node.

[0156] According to an embodiment of the present disclosure, wherein the alarm node includes an alarm node risk assignment, the standard degree calculation subunit is also used to obtain the directed edge risk assignment from the current alarm node to the adjacent alarm node based on the sum of the alarm node risk assignment of the current alarm node and the alarm node risk assignment of the adjacent alarm node.

[0157] According to an embodiment of the present disclosure, the standard degree calculation subunit is further used to calculate the standard directed degree based on all directed edge risk assignments of the current alarm node.

[0158] According to an embodiment of the present disclosure, the standard directional degree includes the standard directional degree of the outgoing edge and the standard directional degree of the incoming edge, and the special node selection module includes a key fault node selection unit and a most severely affected node selection unit, the key fault node selection unit is used to select the alarm node with the largest standard directional degree of the outgoing edge among the M alarm nodes as the key fault node; and the standard directional degree of the incoming edge is used to select the alarm node with the largest standard directional degree of the incoming edge among the M alarm nodes as the most severely affected node.

[0159] According to an embodiment of the present disclosure, the handling module includes a first handling unit and a second handling unit, wherein the first handling unit is used to generate an emergency handling instruction for the most severely affected node, and the emergency handling instruction is used to notify relevant responsible persons to handle the most severely affected node; the second handling unit is used to establish an event sheet involving the key fault node for the key fault node, and the event sheet is used to continuously monitor the key fault node involved in the event sheet.

[0160] According to an embodiment of the present disclosure, the device further includes: an alarm information judgment module and a directed graph use module, the receiving module is also used to receive alarm information of a second time period; the alarm information judgment module is used to judge whether the directed graph generated in the first time period is valid in the second time period; and the directed graph use module is used to use the directed graph generated in the first time period if the directed graph generated in the first time period is valid, wherein the judgment method includes: judging whether the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period; and if the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period, then using the directed graph generated in the first time period.

[0161] According to an embodiment of the present disclosure, any multiple modules of the receiving module 1110, the directed graph establishment module 1120, the special node selection module 1130 and the disposal module 1140 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the receiving module 1110, the directed graph establishment module 1120, the special node selection module 1130 and the disposal module 1140 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware and firmware or by a suitable combination of any of them. Alternatively, at least one of the receiving module 1110, the directed graph establishing module 1120, the special node selecting module 1130 and the handling module 1140 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0162] Fig.12 A block diagram of an electronic device suitable for implementing an alarm management method according to an embodiment of the present disclosure is schematically shown.

[0163] like Fig.12 As shown, the electronic device 1200 according to an embodiment of the present disclosure includes a processor 1201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1202 or a program loaded from a storage part 1208 into a random access memory (RAM) 1203. The processor 1201 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1201 may also include an onboard memory for caching purposes. The processor 1201 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0164] In RAM 1203, various programs and data required for the operation of electronic device 1200 are stored. Processor 1201, ROM 1202 and RAM 1203 are connected to each other via bus 1204. Processor 1201 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1202 and / or RAM 1203. It should be noted that the program can also be stored in one or more memories other than ROM 1202 and RAM 1203. Processor 1201 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0165] According to an embodiment of the present disclosure, the electronic device 1200 may further include an input / output (I / O) interface 1205, which is also connected to the bus 1204. The electronic device 1200 may further include one or more of the following components connected to the I / O interface 1205: an input portion 1206 including a keyboard, a mouse, etc.; an output portion 1207 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1208 including a hard disk, etc.; and a communication portion 1209 including a network interface card such as a LAN card, a modem, etc. The communication portion 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the I / O interface 1205 as needed. A removable medium 1211, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1210 as needed, so that a computer program read therefrom is installed into the storage portion 1208 as needed.

[0166] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0167] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1202 and / or RAM 1203 described above and / or one or more memories other than ROM 1202 and RAM 1203.

[0168] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the item recommendation method provided by the embodiment of the present disclosure.

[0169] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1201. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0170] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1209, and / or installed from the removable medium 1211. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0171] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1209, and / or installed from the removable medium 1211. When the computer program is executed by the processor 1201, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0172] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0173] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0174] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0175] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An alarm management method, comprising: Receive access data and alarm information in a first time period, wherein the access data and alarm information are for M alarm nodes, where M is a positive integer; Establishing a directed graph based on the access data and the alarm information, wherein the directed graph is a directed graph of M alarm nodes; Selecting a special node from the M alarm nodes of the directed graph, wherein the special node includes K types, where K is a positive integer; and The special node is processed according to a preset processing logic, where the preset processing logic includes sub-logics corresponding to the K categories one by one.

2. The method according to claim 1, wherein: The establishing of a directed graph based on the access data and the alarm information comprises: establishing an access relationship between the M alarm nodes based on the access data and the alarm information, wherein the alarm information includes an alarm sequence; and Based on the alarm sequence, a depth traversal algorithm is used to calculate the standard directional degrees of the M alarm nodes through the access relationship.

3. The method according to claim 2, wherein: The establishing of the access relationship between the M alarm nodes based on the access data and the alarm information includes: According to the alarm sequence, the access relationship between the M alarm nodes is determined, in, For any alarm node, determine the outgoing and incoming edges. in, For the outgoing edge, if the adjacent alarm node of the current alarm node satisfies the outgoing edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the outgoing edge, and the outgoing edge rule includes: the adjacent alarm node has visited the current alarm node, or the adjacent alarm node is the front node of the current alarm node; For the incoming edge, when the adjacent alarm node of the current alarm node satisfies the incoming edge rule, the direction from the current alarm node to the adjacent alarm node is determined as the incoming edge. The incoming edge rule includes: the current alarm node has visited the adjacent alarm node, or the adjacent alarm node is the backend node of the current alarm node.

4. The method according to claim 2 or 3, wherein: The method of calculating the standard directional degrees of the M alarm nodes based on the alarm sequence and using a depth traversal algorithm through the access relationship includes: For any alarm node, based on the current alarm node as the starting point, visit the adjacent alarm nodes of the current alarm node until all the adjacent alarm nodes of the alarm node are visited; Calculate the standard directed degrees from the alarm node to all adjacent alarm nodes; and When all the adjacent alarm nodes of the current alarm node have been visited, the last visited adjacent alarm node is used as the next alarm node.

5. The method according to claim 4, wherein: The standard for calculating the alarm node to all adjacent alarm nodes is directional, including: Calculate the risk value of the directed edge of the alarm node; and Based on the directed edge risk assignment, the standard directed degree of the alarm node is calculated.

6. The method according to claim 4, wherein: The alarm node includes an alarm node risk assignment, The step of calculating the directed edge risk assignment of the alarm node includes: Based on the sum of the alarm node risk assignment of the current alarm node and the alarm node risk assignment of the adjacent alarm nodes, the risk assignment of the directed edge from the current alarm node to the adjacent alarm nodes is obtained.

7. The method according to claim 5, wherein: The step of calculating the standard directed degree of the alarm node based on the directed edge risk assignment includes: Based on the risk assignments of all directed edges of the current alarm node, the standard directed degree is calculated.

8. The method according to any one of claims 5 to 7, wherein: The standard orientation includes the outgoing edge standard orientation and the incoming edge standard orientation. The selecting of a special node from the M alarm nodes of the directed graph comprises: Select the alarm node with the largest outgoing edge standard direction among the M alarm nodes as the key fault node; and The alarm node with the largest standard direction of the incoming edge among the M alarm nodes is selected as the node most seriously affected.

9. The method according to claim 8, wherein: The special node is handled according to a preset handling logic, wherein the preset handling logic includes sub-logics corresponding to the K types one by one, including: Generate an emergency handling instruction for the most seriously affected node, wherein the emergency handling instruction is used to notify relevant responsible persons to handle the most seriously affected node; For the key fault node, an event sheet involving the key fault node is established, and the event sheet is used to continuously monitor the key fault node involved in the event sheet.

10. The method according to claim 1, wherein: The method further comprises: receiving alarm information of a second time period; determining whether the directed graph generated in the first time period is valid in a second time period; and If the directed graph generated in the first time period is valid, using the directed graph generated in the first time period, The judgment methods include: Determining whether the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period; and In the case that the alarm information and the device corresponding to the alarm information in the second time period are consistent with those in the first time period, the directed graph generated in the first time period is used.

11. An alarm management device, comprising: A receiving module, configured to receive access data and alarm information in a first time period, wherein the access data and alarm information are for M alarm nodes, where M is a positive integer; A directed graph establishing module, used to establish a directed graph based on the access data and the alarm information, wherein the directed graph is a directed graph of M alarm nodes; A special node selection module, used for selecting a special node from the M alarm nodes of the directed graph, wherein the special node includes K types, where K is a positive integer; and A processing module is used to process the special node according to a preset processing logic, wherein the preset processing logic includes sub-logics corresponding to the K categories one by one.

12. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 10.

Images