Automatic operation and maintenance intelligent alarm processing method and device, equipment and storage medium

Abstract

Embodiments of the present application provide an automatic operation and maintenance intelligent alarm handling method, device, equipment and storage medium, the method comprises: collecting state information of a preset node of a target system; preprocessing the state information of the preset node, identifying abnormal data in the preprocessed state information, generating alarm information according to the identified abnormal data; filtering the generated alarm information, determining the category and priority of different filtered alarm information, and constructing an alarm information relationship graph for the alarm information after determining the category and priority; based on the alarm information relationship graph, determine the alarm resolution strategy, and automatically execute the alarm resolution strategy, realize intelligent classification, deduplication, correlation analysis and priority sorting of massive operation and maintenance alarms, can automatically identify and quickly respond to key alarms, effectively reduce alarm noise, reduce false positives and omissions.

Description

Technical Field

[0001] This application relates to the field of big data analytics technology, specifically to an automated operation and maintenance intelligent alarm handling method, device, computer equipment, and storage medium. Background Technology

[0002] With the rapid development of internet technology and the acceleration of enterprise digital transformation, alarm data generated by data centers and various IT systems is exploding. This alarm data is not only massive in quantity but also diverse in type, covering hardware failures, software anomalies, network congestion, and many other aspects. It also brings problems to operations and maintenance, such as a surge in alarm numbers, low efficiency of manual processing, limitations in handling single-item and multi-item alarms, a lack of fault diagnosis functions, and low levels of intelligent alarm handling.

[0003] Existing operation and maintenance (O&M) methods struggle to cope with the rapidly growing and increasingly complex O&M needs. Their alarm information processing capabilities are limited: traditional systems primarily focus on alarms related to single events, lacking the ability to handle alarms related to comprehensive events. This results in limited alarm information display methods, failing to comprehensively reflect the system status. Furthermore, the systems lack the ability to comprehensively analyze alarm information, unable to extract comprehensive fault information from multiple alarm events, hindering rapid fault location and resolution. Root cause localization is ineffective: the quality of the configuration management database is a key factor affecting root cause localization. The database may fail to update system change information in a timely manner, leading to inaccurate root cause localization. The lack of intelligent reasoning mechanisms based on big data and machine learning prevents the automatic identification and location of the root cause of faults from massive amounts of alarm data. Automation is low: alarm information processing often relies heavily on manual intervention, increasing the workload of O&M personnel and reducing O&M efficiency. The inability to automatically process and respond to alarm information leads to low O&M efficiency. Intelligence is low: the lack of intelligent decision support functions prevents the provision of accurate fault handling suggestions and decision support to O&M personnel. The system has shortcomings in visualizing alarm information, making it difficult to intuitively reflect the system status and the importance of alarm information. Its fault response capabilities are insufficient: under extreme weather conditions or high system load, it may fail to respond to and process alarm information in a timely manner, leading to escalation of faults and increased losses. Furthermore, the system lacks self-healing capabilities, failing to automatically recover from faults or mitigate their impact. Summary of the Invention

[0004] This application provides an automated operation and maintenance intelligent alarm handling method, device, computer equipment, and storage medium.

[0005] The first aspect of this application provides an automated operation and maintenance intelligent alarm handling method, including:

[0006] Collect the status information of preset nodes in the target system;

[0007] The status information of preset nodes is preprocessed, abnormal data in the preprocessed status information is identified, and alarm information is generated based on the identified abnormal data.

[0008] The generated alarm information is filtered to determine the category and priority of different filtered alarm information, and an alarm information relationship diagram is constructed for the alarm information after the category and priority are determined.

[0009] Based on the alarm information relationship diagram, an alarm resolution strategy is determined and automatically executed.

[0010] In an optional embodiment of this application, the collection of the status information of the preset nodes of the target system includes:

[0011] Deploy a pre-defined monitoring agent component on a pre-defined node of the target system;

[0012] The status information of each preset node is collected by the monitoring agent component deployed on each preset node;

[0013] The collected status information of each preset node is sent to the preprocessing module, which has already preprocessed the status information of the preset nodes.

[0014] In an optional embodiment of this application, before sending the collected status information of each preset node to the preprocessing module, the method includes:

[0015] Extract the feature vectors of the state information of each preset node;

[0016] A sensitivity scoring model for the state information of each preset node is constructed to evaluate the sensitivity of the state information of each preset node and classify the sensitivity. Based on the classification results, the sensitive data of the state information of each preset node is encrypted and sent to the preprocessing module. After receiving the encrypted state information, the information preprocessing module decrypts the encrypted state information, stores the state information of each preset node, and performs preprocessing on the state information of each preset node.

[0017] In an optional embodiment of this application, the preprocessing of the state information of the preset node includes:

[0018] Store the status information of the preset nodes;

[0019] The stored state information of the preset nodes is cleaned, transformed, and formatted to obtain preprocessed state information.

[0020] In an optional embodiment of this application, identifying abnormal data in the preprocessed state information includes:

[0021] Preprocessed status information that exceeds a preset threshold or does not conform to preset rules will be treated as abnormal data.

[0022] In an optional embodiment of this application, the step of filtering the generated alarm information, determining the categories and priorities of different filtered alarm information, and constructing an alarm information relationship graph for the alarm information after determining the categories and priorities includes:

[0023] The generated alarm information is deduplicated, and false alarm information is removed to obtain filtered alarm information;

[0024] Each filtered alarm message is input into a pre-trained alarm classification model and alarm priority prediction model to determine the category and priority of different filtered alarm messages;

[0025] Based on the preset relationships between alarm information, an alarm information relationship diagram is constructed for alarm information after the categories and priorities are determined.

[0026] In an optional embodiment of this application, determining the alarm clearance strategy based on the alarm information relationship graph includes:

[0027] The target alarm information is determined based on the alarm information relationship diagram, wherein the target alarm information is the alarm information corresponding to the root cause of the abnormal data;

[0028] Determine the alarm resolution strategy corresponding to the target alarm information.

[0029] A second aspect of this application provides an automated operation and maintenance intelligent alarm handling device, comprising:

[0030] The acquisition module is used to collect the status information of preset nodes in the target system;

[0031] The identification module is used to preprocess the status information of preset nodes, identify abnormal data in the preprocessed status information, and generate alarm information based on the identified abnormal data.

[0032] The filtering module is used to filter the generated alarm information, determine the category and priority of different filtered alarm information, and construct an alarm information relationship diagram for the alarm information after determining the category and priority.

[0033] The determination module is used to determine the alarm cancellation strategy based on the alarm information relationship diagram, and automatically execute the alarm cancellation strategy.

[0034] A third aspect of this application provides a computer device, including: a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the above-mentioned automated operation and maintenance intelligent alarm handling methods.

[0035] A fourth aspect of the embodiments of this application provides a computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the steps of the automated operation and maintenance intelligent alarm handling method as described above.

[0036] Compared with the prior art, the technical solutions provided in this application have at least some or all of the following advantages:

[0037] The automated operation and maintenance intelligent alarm handling method described in this application collects the status information of preset nodes in the target system; preprocesses the status information of the preset nodes, identifies abnormal data in the preprocessed status information, and generates alarm information based on the identified abnormal data; filters the generated alarm information, determines the category and priority of different filtered alarm information, and constructs an alarm information relationship graph for the alarm information after determining the category and priority; based on the alarm information relationship graph, determines the alarm resolution strategy, and automatically executes the alarm resolution strategy. Through automation and intelligence, this method overcomes the problems of low efficiency, slow response, and excessive reliance on manual intervention in traditional operation and maintenance alarm management, significantly improving the processing efficiency and accuracy of operation and maintenance alarms. It achieves intelligent classification, deduplication, correlation analysis, and priority ranking of massive operation and maintenance alarms, can automatically identify and quickly respond to key alarms, effectively reduce alarm noise, and reduce false alarms and missed alarms. Attached Figure Description

[0038] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0039] Figure 1 A flowchart illustrating an automated operation and maintenance intelligent alarm handling method provided in one embodiment of this application;

[0040] Figure 2 A flowchart illustrating the process of collecting state information of preset nodes in a target system, as provided in one embodiment of this application;

[0041] Figure 3 A flowchart illustrating the automatic execution of the alarm cancellation strategy provided in one embodiment of this application;

[0042] Figure 4 This is a schematic diagram of the structure of an automated operation and maintenance intelligent alarm handling device provided in one embodiment of this application;

[0043] Figure 5 This is a schematic diagram of a computer device structure provided in one embodiment of this application. Detailed Implementation

[0044] Please see Figure 1 The automated operation and maintenance intelligent alarm handling method provided in this application includes the following steps 100 to 400:

[0045] Step 100: Collect the status information of the preset nodes of the target system;

[0046] Step 200: Preprocess the status information of the preset nodes, identify abnormal data in the preprocessed status information, and generate alarm information based on the identified abnormal data;

[0047] Step 300: Filter the generated alarm information, determine the categories and priorities of different filtered alarm information, and construct an alarm information relationship diagram for the alarm information after determining the categories and priorities;

[0048] Step 400: Based on the alarm information relationship diagram, determine the alarm cancellation strategy and automatically execute the alarm cancellation strategy.

[0049] In an optional embodiment of this application, see [link to relevant documentation]. Figure 2 In step 100, the collection of the status information of the preset nodes of the target system includes:

[0050] Deploy a pre-defined monitoring agent component on a pre-defined node of the target system. The monitoring agent has the characteristics of high reliability and low resource consumption to ensure minimal impact on system performance.

[0051] The monitoring agent components deployed on each preset node collect the status information of each preset node, including the usage and performance indicators of key resources such as CPU, memory, disk, and network. The data collection frequency can be configured according to business needs, supporting high-frequency and high-precision collection.

[0052] The collected status information of each preset node is sent to the preprocessing module, which has already preprocessed the status information of the preset nodes.

[0053] In an optional embodiment of this application, before sending the collected status information of each preset node to the preprocessing module, the method includes:

[0054] Extract the feature vectors of the state information of each preset node;

[0055] A sensitivity scoring model for the state information of each preset node is constructed to evaluate the sensitivity of the state information of each preset node and classify the sensitivity. Based on the classification results, the sensitive data of the state information of each preset node is encrypted and sent to the preprocessing module. After receiving the encrypted state information, the information preprocessing module decrypts the encrypted state information, stores the state information of each preset node, and performs preprocessing on the state information of each preset node.

[0056] In an optional embodiment of this application, feature vectors of the preprocessed running data are extracted using a preset autoencoder network model.

[0057] In an optional embodiment of this application, the step of constructing an application system information data sensitivity scoring model to evaluate the sensitivity of application system information data and classify it refers to collecting historical application system information data and extracting historical feature vectors, and calculating the mean of the historical feature vectors and setting it as the benchmark data vector.

[0058] Real-time information data of application system is collected and real-time feature vectors are extracted. The K-means clustering algorithm is used to cluster the real-time feature vectors, and the center point of each cluster is selected as the reference data vector.

[0059] By combining the RBF kernel function with integration, the cumulative similarity A(x) between the baseline data vector and the feature vector of the application system information data is calculated, as follows:

[0060]

[0061] Where x is the feature vector of application system information data, x0 is the baseline data vector, and x i This represents the historical feature vector of the information data of the i-th application system.

[0062] The logarithmic transformation B(x) applied to the cumulative similarity A is given by the following formula:

[0063] B(x) = log(1 + A(x));

[0064] The hyperbolic tangent function is introduced to smooth the cumulative similarity of the reference eigenvectors, resulting in the smoothed cumulative similarity C(x), as shown in the formula:

[0065]

[0066] Where M is the number of reference feature vectors, x j Let j be the j-th reference eigenvector;

[0067] Construct a sensitivity scoring model to evaluate the sensitivity score S(x) of the feature vector of information data in the application system. The formula is as follows:

[0068]

[0069] A sensitivity score is set for the historical application system information data. An evaluation threshold is then set, and the sensitivity score of the feature vector of the application system information data is compared with the evaluation threshold. If the sensitivity score of the feature vector of the application system information data is greater than or equal to the evaluation threshold, it is determined to be sensitive data. If the sensitivity score of the feature vector of the application system information data is less than the evaluation threshold, it is determined to be ordinary data.

[0070] In an optional embodiment of this application, the step of encrypting sensitive data in the application system information data based on the classification results refers to using a random number generator to randomly generate a key K;

[0071] The sensitive data is subjected to a nonlinear transformation using exponential and sine functions to obtain a nonlinear transformation result H(x′), as shown in the formula:

[0072]

[0073] Where x′ is sensitive data;

[0074] The sensitive data is subjected to a nonlinear transformation using a logarithmic function and a smoothed arctangent function to obtain the multi-level nonlinear transformation result E(x′), as shown in the formula:

[0075] E(x′)=tan -1 (x′ 2 ·k+log(x′+k));

[0076] Constructing the encryption formula:

[0077] S(x′)=H(x′)+E(x′);

[0078] The sensitive data is then incorporated into the encryption formula for encryption.

[0079] In an optional embodiment of this application, the step of decrypting and storing the exchanged data as application system information data refers to receiving the transmitted encrypted data and the corresponding key K;

[0080] The received data is decrypted using a decryption formula to obtain the decrypted sensitive data O(S). The formula is as follows:

[0081]

[0082] The collected application system information and sensitive data generated from analysis are stored in a database. The application system information and sensitive data generated from analysis in the database are backed up in the cloud, and the integrity of the backup data is checked regularly.

[0083] In an optional embodiment of this application, the preprocessing of the state information of the preset node includes:

[0084] The status information of preset nodes is stored. A distributed storage architecture is adopted to ensure high availability and scalability of data, and a high-performance data storage system is built to receive, store and manage the status information of preset nodes.

[0085] The stored state information of the preset nodes is cleaned, transformed, and formatted to obtain preprocessed state information to meet the needs of subsequent analysis and processing. The data preprocessing process can be automated to reduce manual intervention.

[0086] In an optional embodiment of this application, the preprocessing of the state information of the preset node further includes:

[0087] Data backup and recovery: A robust data recovery mechanism is designed to cope with data loss or damage caused by unexpected situations. The status information of preset nodes is backed up regularly to ensure the security and recoverability of the status information of preset nodes.

[0088] In an optional embodiment of this application, identifying abnormal data in the preprocessed state information includes:

[0089] Preprocessed status information that exceeds a preset threshold or does not conform to preset rules is treated as abnormal data. The preset rules can be time-based rules, etc.

[0090] In an optional embodiment of this application, the step of filtering the generated alarm information, determining the categories and priorities of different filtered alarm information, and constructing an alarm information relationship graph for the alarm information after determining the categories and priorities includes:

[0091] Based on a preset filtering model, the generated alarm information is deduplicated and false alarm information is removed to obtain filtered alarm information. The preset filtering model is trained by historical data and real-time data, which can improve the filtering effect and accuracy.

[0092] Each filtered alarm message is input into a pre-trained alarm classification model and alarm priority prediction model to determine the category and priority of different filtered alarm messages. The alarm classification model classifies the filtered alarm messages according to dimensions such as severity, scope of impact, and fault type.

[0093] Based on the preset correlation between alarm information, an alarm information relationship diagram is constructed for alarm information after the categories and priorities are determined. The diagram automatically identifies the correlation between alarm information and the root cause of alarm information, and realizes functions such as alarm trend analysis and impact range analysis. It analyzes alarm trends, predicts possible fault evolution paths, and provides a basis for decision-making.

[0094] In an optional embodiment of this application, after obtaining the filtered alarm information, the method further includes:

[0095] Display filtered alarm information in the form of a list or chart for quick understanding of alarm status.

[0096] In an optional embodiment of this application, step 400, determining the alarm clearance strategy based on the alarm information relationship graph, includes:

[0097] The target alarm information is determined based on the alarm information relationship diagram, wherein the target alarm information is the alarm information corresponding to the root cause of the abnormal data;

[0098] Determine the alarm resolution strategy corresponding to the target alarm information.

[0099] In an optional embodiment of this application, determining the alarm cancellation strategy corresponding to the target alarm information includes:

[0100] The alarm information is learned and analyzed, and targeted handling suggestions are given based on the learning results, including fault location, repair plan, and preventive measures.

[0101] Predictive algorithms are used to predict the type, time and scope of potential faults that may occur when alarms are triggered, enabling automatic early warning and helping users prepare for fault response in advance.

[0102] Provides a visual decision support interface for viewing and understanding prediction results. The decision-making process may include automatically executing predefined response actions (such as restarting services or allocating resources) or recommending the optimal solution to operations and maintenance personnel.

[0103] In an optional embodiment of this application, see [link to relevant documentation]. Figure 3 The automatic execution of the alarm cancellation strategy includes:

[0104] It provides automated scripts that connect to operation and maintenance automation tools or APIs. Based on alarm resolution policies, it can automatically execute scripts, restart services, adjust resources, and perform other operations. The automated scripts can automatically perform fault location, repair, and other operations, improving the efficiency of fault handling.

[0105] It provides a customizable handling process configuration service to adapt to different business scenarios and fault types. The handling process can include the execution and judgment logic of multiple automated scripts;

[0106] It provides context-aware services to dynamically adjust handling strategies based on the current operating status and resource availability, ensuring minimal business impact. At the same time, it has built-in security mechanisms to ensure that automated handling actions do not trigger new security risks.

[0107] In an optional embodiment of this application, the method further includes:

[0108] Interface Design: Design an intuitive and easy-to-use visual interface to display the system's operating status, alarm information, and intelligent decision-making results;

[0109] Provides chart display services: Displays the data collected throughout the operation and maintenance process, alarm information, analysis results, and handling decisions to operation and maintenance personnel in a graphical interface, and allows customization of chart styles and display content;

[0110] Provides interactive features: Users can perform operations such as querying, filtering, and sorting through the interface to help them explore the reasons and patterns behind the data.

[0111] The following describes the application process of the automated operation and maintenance intelligent alarm method of this application, including the following steps:

[0112] The first step is status information collection and transmission: Monitoring agents are deployed on key nodes of the target system to ensure real-time collection of status information for critical system resources, such as CPU, memory, disk, and network. Message queues are used to buffer and asynchronously transmit the collected status information, ensuring reliable and efficient data transmission.

[0113] The second step is data processing and storage: Pre-processing operations such as initial cleaning, format conversion, and compression are performed on the collected status information to remove invalid or erroneous data. Simultaneously, preset filtering rules or machine learning models are used to filter the pre-processed data and identify potential alarm messages.

[0114] The third step is alarm generation and filtering: based on preset thresholds and rules, abnormal data is converted into alarm information. Intelligent filtering algorithms are applied, such as deduplication based on text similarity and false alarm identification based on historical data, to reduce alarm noise.

[0115] The fourth step is alarm classification and correlation analysis: A machine learning model is trained to classify alarms based on features such as alarm description, source, and historical data, categorizing them into different types and priorities. Graph databases and association rule learning algorithms are used to establish causal relationship graphs between alarms, aiding in locating the root cause of problems.

[0116] The fifth step is intelligent decision-making: Based on alarm classification, historical handling cases, and business impact assessment, the intelligent decision-making unit recommends or automatically formulates handling strategies through a rule engine or more complex AI algorithms. Simultaneously, an implementation risk assessment is conducted to ensure the security and feasibility of the selected strategies.

[0117] Step 6, Automated Execution: Based on the decision results, automatically execute pre-set scripts or operations, such as resource adjustments or service restarts. Monitor and provide feedback on the execution process to ensure tasks are performed as expected, and record the results.

[0118] Step 7: Visualized Monitoring and Reporting: Display alarm status, handling progress, system health indicators, and other information through a web interface, using charts and dashboards for visualization. Implement customized reporting functionality, supporting users to define time ranges, alarm types, etc., to generate operation and maintenance reports and provide a basis for management decisions.

[0119] Step 8, Continuous Optimization and Learning: Collect handling results and system feedback to continuously optimize alarm rules, decision-making algorithms, and automation scripts. Through iterative training of machine learning models, improve the accuracy of alarm classification, root cause analysis, and decision-making, forming a closed-loop continuous improvement mechanism.

[0120] This application's automated operation and maintenance intelligent alarm method spans hardware devices, operating systems, and application software across different platforms, uniformly managing and analyzing alarm information from diverse data sources. It achieves global operation and maintenance management, utilizing reinforcement learning or deep learning techniques to automatically optimize alarm identification, classification, and prioritization based on historical data and feedback from operation and maintenance personnel. This reduces false alarms and missed alarms, improving the accuracy and efficiency of alarm handling. By employing deep learning or graph algorithms, it automatically correlates and analyzes causal relationships between alarms, quickly locating the root cause of problems rather than merely addressing surface symptoms. This also predicts potential future problems, enabling proactive operation and maintenance decisions. It can dynamically adjust alarm triggering conditions based on system operating status, avoiding oversensitivity or insensitivity caused by fixed thresholds, ensuring the effectiveness of alarms. Through the integration of an intelligent decision engine, it automatically or recommends appropriate handling measures based on alarm classification and analysis results, executing them via APIs or automated scripts, reducing manual intervention.

[0121] The automated operation and maintenance intelligent alarm method of this application uses machine learning prediction models to perform forward-looking analysis of faults, provide early warning of potential problems, and achieve predictive maintenance. It realizes comprehensive monitoring and intelligent analysis of operation and maintenance management data, thereby effectively reducing manual intervention, lowering the false alarm rate, improving the efficiency and response speed of operation and maintenance management, significantly improving the speed and accuracy of alarm processing, optimizing the allocation of operation and maintenance resources, reducing the need for manual intervention, enhancing the stability and business continuity of IT systems, and at the same time significantly reducing operation and maintenance costs and improving the overall efficiency and quality of operation and maintenance.

[0122] This application's automated operation and maintenance intelligent alarm method integrates advanced artificial intelligence technology and algorithms to automatically identify and classify alarm information. It is a comprehensive system integrating status information collection, alarm information processing, intelligent decision-making, and automated handling functions. The system can quickly analyze the source, type, and scope of impact of alarm information, providing operation and maintenance personnel with accurate and timely alarm notifications and handling suggestions. It aims to improve operation and maintenance efficiency, reduce human error, achieve intelligent and automated operation and maintenance, and provide enterprises with more stable and reliable IT system support.

[0123] It should be understood that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order constraint on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the diagram may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0124] Please see Figure 4 One embodiment of this application provides an automated operation and maintenance intelligent alarm handling device 400, comprising:

[0125] The acquisition module 410 is used to acquire the status information of preset nodes of the target system;

[0126] The identification module 420 is used to preprocess the status information of the preset node, identify abnormal data in the preprocessed status information, and generate alarm information based on the identified abnormal data.

[0127] The filtering module 430 is used to filter the generated alarm information, determine the category and priority of different filtered alarm information, and construct an alarm information relationship diagram for the alarm information after determining the category and priority.

[0128] The determination module 440 is used to determine the alarm cancellation strategy based on the alarm information relationship diagram and automatically execute the alarm cancellation strategy.

[0129] The automated operation and maintenance intelligent alarm handling device of this application performs highly automated and intelligent alarm processing, which greatly improves the efficiency and accuracy of alarm processing, reduces manual intervention, accelerates fault location and recovery, optimizes resource allocation, reduces operating costs, ensures business continuity, and continuously optimizes itself through machine learning, providing the operation and maintenance team with in-depth insights and decision support, bringing intelligent and efficient technological innovation to operation and maintenance management.

[0130] The automated operation and maintenance intelligent alarm handling device of this application effectively reduces the number of alarms (i.e., reduces alarm storms) through intelligent filtering and aggregation mechanisms, ensuring that the operation and maintenance team only focuses on the most critical and effective alarm information, improving the timeliness and accuracy of alarm handling, and achieving efficient alarm management. Utilizing advanced data analysis and machine learning algorithms, it automates alarm classification, correlation analysis, and root cause identification, greatly shortening the time from alarm triggering to fault location, improving fault handling efficiency, and enabling rapid fault location. Based on the results of intelligent analysis, it automatically executes or recommends the optimal handling strategy, reducing manual intervention. At the same time, through a closed-loop feedback mechanism, it continuously optimizes the handling strategy, improving the automation level and decision-making quality of operation and maintenance, realizing automated handling and optimization, rapid response, and efficient problem-solving capabilities. This helps maintain and improve business continuity, reduce service interruption time, increase customer satisfaction and trust, and enhance business continuity.

[0131] The automated operation and maintenance intelligent alarm handling device of this application utilizes machine learning predictive models to perform proactive fault analysis and provide early warnings of potential problems. This predictive maintenance capability helps operation and maintenance personnel take measures in advance to avoid faults or mitigate their impact on the system, achieving predictive maintenance. By integrating multiple functions such as status information collection, cloud platform processing, alarm information filtering and classification analysis, the system can monitor the system's operating status in real time and conduct in-depth analysis of alarm information, providing strong support for operation and maintenance decisions. Comprehensive monitoring and intelligent analysis enable comprehensive monitoring and intelligent analysis of operation and maintenance management data. Through intelligent algorithms, similar alarms are automatically clustered, effectively reducing alarm storms and redundant information, allowing the operation and maintenance team to focus on the core alarms that truly require attention, improving alarm processing efficiency and achieving efficient alarm management. Machine learning technology is used to analyze the correlation between alarms and automatically generate alarms. The causal relationship diagram between alarms helps maintenance personnel quickly locate the root cause of faults, shorten troubleshooting time, and accurately pinpoint problems. Through intelligent classification and prioritization of alarm information, the system can allocate maintenance resources more rationally, prioritize the handling of critical alarms, ensure stable system operation, and avoid unnecessary resource waste. Resource optimization configuration and automatic execution of preset repair scripts, resource allocation, or rollback operations reduce manual intervention and improve problem resolution speed. Automated response and execution enable automatic response mechanisms for specific types of alarms. The automated and intelligent maintenance alarm handling system can reduce the additional costs caused by manual intervention and false alarms / missed alarms, thereby reducing maintenance costs. By optimizing resource allocation and improving maintenance efficiency, the system helps reduce overall maintenance costs.

[0132] For specific limitations regarding the aforementioned device 400, please refer to the limitations on the pseudo-random sequence generation method described above, which will not be repeated here. Each module in the aforementioned device 400 can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in a computer device, or stored in software in the memory of a computer device, so that the processor can call and execute the operations corresponding to each module.

[0133] In one embodiment, a computer device is provided, the internal structure of which can be as follows: Figure 5As shown. The computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system, computer programs, and the database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements the pseudo-random sequence generation method described above. It includes: memory and a processor; the memory stores the computer program; and the processor executes the computer program to implement any step of the pseudo-random sequence generation method described above.

[0134] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, can perform any of the steps in the pseudo-random sequence generation method described above.

[0135] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0137] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0138] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0139] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0140] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An automated operation and maintenance intelligent alarm handling method, characterized in that, include: Collect the status information of preset nodes in the target system; The status information of preset nodes is preprocessed, abnormal data in the preprocessed status information is identified, and alarm information is generated based on the identified abnormal data. The generated alarm information is filtered to determine the category and priority of different filtered alarm information, and an alarm information relationship diagram is constructed for the alarm information after the category and priority are determined. Based on the alarm information relationship diagram, an alarm clearance strategy is determined and automatically executed. The status information of the preset nodes of the target system being collected includes: Deploy a pre-defined monitoring agent component on a pre-defined node of the target system; The status information of each preset node is collected by the monitoring agent component deployed on each preset node; The collected status information of each preset node is sent to the preprocessing module, which has already preprocessed the status information of the preset nodes. The method includes the following steps before sending the collected status information of each preset node to the preprocessing module: Extract the feature vectors of the state information of each preset node; A sensitivity scoring model for the state information of each preset node is constructed to evaluate the sensitivity of the state information of each preset node and classify the sensitivity. Based on the classification results, the sensitive data of the state information of each preset node is encrypted and sent to the preprocessing module. After receiving the encrypted state information, the information preprocessing module decrypts the encrypted state information, stores the state information of each preset node, and performs preprocessing on the state information of each preset node. Construct a sensitivity scoring model to evaluate the sensitivity score of the feature vectors of information data in the application system. The formula is: ； A sensitivity score assessment threshold is set for historical application system information data. The sensitivity score of the application system information data feature vector is compared with the assessment threshold. If the sensitivity score of the application system information data feature vector is greater than or equal to the assessment threshold, it is determined to be sensitive data. By combining the RBF kernel function with integration, the cumulative similarity A(x) between the baseline data vector and the feature vector of the application system information data is calculated, as follows: ， Where x is the feature vector of information data in the application system. As the baseline data vector, This represents the historical feature vector of the information data of the i-th application system. Logarithmic transformation of cumulative similarity A The formula is: ； The hyperbolic tangent function is introduced to smooth the cumulative similarity of the reference eigenvectors, resulting in the smoothed cumulative similarity. The formula is: ， Where M is the number of reference feature vectors, x j Let be the j-th reference feature vector.

2. The method according to claim 1, characterized in that, The preprocessing of the state information of the preset nodes includes: Store the status information of the preset nodes; The stored state information of the preset nodes is cleaned, transformed, and formatted to obtain preprocessed state information.

3. The method according to claim 1, characterized in that, The identification of abnormal data in the preprocessed state information includes: Preprocessed status information that exceeds a preset threshold or does not conform to preset rules will be treated as abnormal data.

4. The method according to claim 1, characterized in that, The process of filtering the generated alarm information, determining the categories and priorities of different filtered alarm information, and constructing an alarm information relationship graph for the alarm information after determining the categories and priorities includes: The generated alarm information is deduplicated, and false alarm information is removed to obtain filtered alarm information; Each filtered alarm message is input into a pre-trained alarm classification model and alarm priority prediction model to determine the category and priority of different filtered alarm messages; Based on the preset relationships between alarm information, an alarm information relationship diagram is constructed for alarm information after the categories and priorities are determined.

5. The method according to claim 1, characterized in that, The step of determining the alarm clearance strategy based on the alarm information relationship diagram includes: The target alarm information is determined based on the alarm information relationship diagram, wherein the target alarm information is the alarm information corresponding to the root cause of the abnormal data; Determine the alarm resolution strategy corresponding to the target alarm information.

6. An automated operation and maintenance intelligent alarm handling device, characterized in that, include: The acquisition module is used to collect the status information of preset nodes in the target system; The identification module is used to preprocess the status information of preset nodes, identify abnormal data in the preprocessed status information, and generate alarm information based on the identified abnormal data. The filtering module is used to filter the generated alarm information, determine the category and priority of different filtered alarm information, and construct an alarm information relationship diagram for the alarm information after determining the category and priority. The determination module is used to determine the alarm clearance strategy based on the alarm information relationship diagram, and automatically execute the alarm clearance strategy. The status information of the preset nodes of the target system being collected includes: Deploy a pre-defined monitoring agent component on a pre-defined node of the target system; The status information of each preset node is collected by the monitoring agent component deployed on each preset node; The collected status information of each preset node is sent to the preprocessing module, which has already preprocessed the status information of the preset nodes. Specifically, before sending the collected status information of each preset node to the preprocessing module, Extract the feature vectors of the state information of each preset node; A sensitivity scoring model for the state information of each preset node is constructed to evaluate the sensitivity of the state information of each preset node and classify the sensitivity. Based on the classification results, the sensitive data of the state information of each preset node is encrypted and sent to the preprocessing module. After receiving the encrypted state information, the information preprocessing module decrypts the encrypted state information, stores the state information of each preset node, and performs preprocessing on the state information of each preset node. Construct a sensitivity scoring model to evaluate the sensitivity score of the feature vectors of information data in the application system. The formula is: ； A sensitivity score assessment threshold is set for historical application system information data. The sensitivity score of the application system information data feature vector is compared with the assessment threshold. If the sensitivity score of the application system information data feature vector is greater than or equal to the assessment threshold, it is determined to be sensitive data. By combining the RBF kernel function with integration, the cumulative similarity A(x) between the baseline data vector and the feature vector of the application system information data is calculated, as follows: ， Where x is the feature vector of information data in the application system. As the baseline data vector, This represents the historical feature vector of the information data of the i-th application system. Logarithmic transformation of cumulative similarity A The formula is: ； The hyperbolic tangent function is introduced to smooth the cumulative similarity of the reference eigenvectors, resulting in the smoothed cumulative similarity. The formula is: ， Where M is the number of reference feature vectors, x j Let be the j-th reference feature vector.

7. A computer device, comprising: A memory and a processor, wherein the memory stores a computer program, characterized in that the processor executes the computer program to implement the steps of the automated operation and maintenance intelligent alarm handling method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the automated operation and maintenance intelligent alarm handling method according to any one of claims 1 to 5.

Images