Alarm system and method, electronic equipment and storage medium

Abstract

The invention provides an alarm system and method, electronic equipment and a storage medium, and the system comprises a change data collection module which is used for obtaining historical change data of a monitoring system and corresponding historical alarm data; the intelligent judgment module is used for training by using the historical change data and the historical alarm data to obtain a target alarm model; the change data collection module is used for sequentially acquiring first change data of the monitoring system and sending the first change data to the intelligent judgment module; the intelligent judgment module is used for judging the first change data according to the target alarm model to obtain first alarm data and sending the first alarm data to the alarm noise reduction module; and the alarm noise reduction module is used for processing the plurality of pieces of first alarm data to obtain processed target alarm data, and giving an alarm according to the target alarm data. The accuracy of the alarm data is improved, the noise interference is effectively reduced, and accurate pushing is realized.

Description

Technical Field

[0001] The present application relates to the field of information monitoring technology, and in particular to an alarm system, method, electronic device and storage medium. Background Art

[0002] With the rapid development of information technology, the level of enterprise informatization continues to improve, making system operation and maintenance increasingly complex. In the daily operation and maintenance process, change operations and alarm events occur frequently, becoming an important challenge that operation and maintenance personnel must face. System changes usually involve multiple aspects, such as configuration modifications, software upgrades, hardware replacements, etc. These changes often affect the system operation status, thereby triggering alarms.

[0003] In the prior art, the alarm method for these information changes is to alarm one by one, that is, an alarm will be issued as long as the data changes. This situation requires operation and maintenance personnel to spend a lot of time and energy on manual screening and analysis, which seriously affects the operation and maintenance efficiency. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide an alarm system, method, electronic device and storage medium to overcome the problems in the prior art.

[0005] In a first aspect, an embodiment of the present application provides an alarm system, the alarm system comprising: a change data collection module, an intelligent judgment module and an alarm noise reduction module, the change data collection module is connected to a monitoring system and a process platform, the change data collection module is connected to the intelligent judgment module, and the intelligent judgment module is connected to the alarm noise reduction module;

[0006] The change data collection module is used to obtain the historical change data and corresponding historical alarm data of the monitoring system and process platform, and send the historical change data and the historical alarm data to the intelligent judgment module;

[0007] The intelligent judgment module is used to train a target alarm model using the historical change data and the historical alarm data;

[0008] The change data collection module is used to sequentially obtain the first change data of the monitoring system and send the first change data to the intelligent judgment module;

[0009] The intelligent judgment module is used to judge each of the first change data using the target alarm model to obtain first alarm data, and send the first alarm data to the alarm noise reduction module;

[0010] The alarm noise reduction module is used to process the plurality of the first alarm data to obtain processed target alarm data, and issue an alarm based on the target alarm data.

[0011] In some technical solutions of the present application, the intelligent judgment module is further used to train a new alarm model using the historical change data and the historical alarm data, the first change data and the first alarm data;

[0012] The change data collection module is used to sequentially obtain the second change data of the monitoring system and send the second change data to the intelligent judgment module;

[0013] The intelligent judgment module is used to judge each of the second change data by using the new alarm model to obtain second alarm data, and send the second alarm data to the alarm noise reduction module;

[0014] The alarm noise reduction module is used to process the plurality of second alarm data to obtain processed new alarm data, and issue an alarm based on the new alarm data.

[0015] In some technical solutions of the present application, the intelligent judgment module is used to judge each of the first change data using the target alarm model to obtain the first alarm data, and send the first alarm data to the alarm noise reduction module, including:

[0016] Using the target alarm model to process each of the first change data, to obtain an alarm type and first alarm data of the first change data;

[0017] If the first change data is an associated alarm, the first alarm data is sent to the alarm noise reduction module.

[0018] In some technical solutions of the present application, the above-mentioned intelligent judgment module is also used to issue an alarm based on the first alarm data if the first change data is a normal alarm.

[0019] In some technical solutions of the present application, the alarm noise reduction module is used to process the plurality of the first alarm data to obtain processed target alarm data, and to issue an alarm based on the target alarm data, including:

[0020] The target alarm data is obtained by compressing the plurality of the first alarm data or changing the alarm level of the first alarm data, and an alarm is issued according to the target alarm data.

[0021] In some technical solutions of the present application, the above-mentioned historical change data includes a plurality of first sub-data, and the above-mentioned historical alarm data includes a plurality of second sub-data;

[0022] The intelligent judgment module is used to train a target alarm model using the historical change data and the historical alarm data, including:

[0023] According to the correlation between the first sub-data and the second sub-data, the historical change data and the historical alarm data are combined to obtain historical combination data;

[0024] A target warning model is obtained by training using the target feature field in the historical combined data.

[0025] In some technical solutions of the present application, the above-mentioned target warning model is a KNN algorithm model.

[0026] In a second aspect, an embodiment of the present application provides an alarm method, which is applied to an alarm system, wherein the alarm system includes: a change data collection module, an intelligent judgment module, and an alarm noise reduction module, wherein the change data collection module is connected to a monitoring system and a process platform, wherein the change data collection module is connected to the intelligent judgment module, wherein the intelligent judgment module is connected to the alarm noise reduction module, and wherein the method includes:

[0027] The change data collection module obtains the historical change data and corresponding historical alarm data of the monitoring system and process platform, and sends the historical change data and the historical alarm data to the intelligent judgment module;

[0028] The intelligent judgment module uses the historical change data and the historical alarm data to train a target alarm model;

[0029] The change data collection module sequentially obtains the first change data of the monitoring system, and sends the first change data to the intelligent judgment module;

[0030] The intelligent judgment module judges each of the first change data by using the target alarm model to obtain first alarm data, and sends the first alarm data to the alarm noise reduction module;

[0031] The alarm noise reduction module processes the plurality of the first alarm data to obtain processed target alarm data, and issues an alarm based on the target alarm data.

[0032] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned alarm method when executing the computer program.

[0033] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned alarm method are executed.

[0034] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0035] The alarm system of the present application includes: a change data collection module, an intelligent judgment module and an alarm noise reduction module, wherein the change data collection module is connected to a monitoring system and a process platform, the change data collection module is connected to the intelligent judgment module, and the intelligent judgment module is connected to the alarm noise reduction module; the change data collection module is used to obtain historical change data and corresponding historical alarm data of the monitoring system and the process platform, and send the historical change data and the historical alarm data to the intelligent judgment module; the intelligent judgment module is used to train a target alarm model using the historical change data and the historical alarm data; the change data collection module is used to sequentially obtain the first change data of the monitoring system, and send the first change data to the intelligent judgment module; the intelligent judgment module is used to judge each of the first change data using the target alarm model to obtain the first alarm data, and send the first alarm data to the alarm noise reduction module; the alarm noise reduction module is used to process multiple first alarm data to obtain processed target alarm data, and issue an alarm based on the target alarm data. It not only improves the accuracy of alarm data, but also effectively reduces noise interference and achieves accurate push.

[0036] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A schematic diagram of an alarm system provided by an embodiment of the present application is shown;

[0039] Figure 2 A schematic diagram of another alarm system provided in an embodiment of the present application is shown;

[0040] Figure 3A schematic diagram of a process of an alarm method provided in an embodiment of the present application is shown;

[0041] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0043] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0044] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0045] With the rapid development of information technology, the level of enterprise informatization continues to improve, making the complexity of system operation and maintenance increasingly prominent. In the daily operation and maintenance process, change operations and alarm events occur frequently, which has become an important challenge that operation and maintenance personnel must face. System changes usually involve multiple aspects, such as configuration modifications, software upgrades, hardware replacements, etc. These changes often have an impact on the system's operating status, thereby triggering alarms. However, when processing these large numbers of alarms, the current alarm management system often finds it difficult to effectively distinguish temporary alarms caused by change operations from real system abnormality alarms. This situation causes operation and maintenance personnel to spend a lot of time and energy on manual screening and analysis, which seriously affects the efficiency of operation and maintenance.

[0046] At present, the alarm processing method and alarm processing system for changes in IT operation and maintenance are to set configuration items for each alarm and work order on the alarm platform and the change platform, and analyze whether each alarm is caused by the change by rule matching. However, this method is highly dependent on configuration, which increases the complexity and difficulty of user operation. Users need to fill in various configuration items accurately, otherwise the alarm processing may be inaccurate or invalid. Secondly, this method lacks sufficient intelligence and cannot automatically adapt to different scenarios and needs. It requires users to manually perform a lot of configuration and adjustment, and it is too dependent on personal active judgment. During the change process, if the setting is improper or the configuration is wrong, the method may mistakenly block the alarm that should have been issued, or when an unexpected abnormal alarm occurs during the change, it will be missed due to shielding and filtering, thereby missing the opportunity to discover system hidden dangers in a timely manner.

[0047] Based on this, the embodiments of the present application provide an alarm system, method, electronic device and storage medium, which are described below through embodiments. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0048] Figure 1 and Figure 2 A schematic diagram of an alarm system provided by an embodiment of the present application is shown, the alarm system comprising: a change data collection module, an intelligent judgment module and an alarm noise reduction module, the change data collection module is connected to a monitoring system and a process platform, the change data collection module is connected to the intelligent judgment module, and the intelligent judgment module is connected to the alarm noise reduction module;

[0049] The change data collection module is used to obtain the historical change data and corresponding historical alarm data of the monitoring system and process platform, and send the historical change data and the historical alarm data to the intelligent judgment module;

[0050] The intelligent judgment module is used to train a target alarm model using the historical change data and the historical alarm data;

[0051] The change data collection module is used to sequentially obtain the first change data of the monitoring system and send the first change data to the intelligent judgment module;

[0052] The intelligent judgment module is used to judge each of the first change data using the target alarm model to obtain first alarm data, and send the first alarm data to the alarm noise reduction module;

[0053] The alarm noise reduction module is used to process the plurality of the first alarm data to obtain processed target alarm data, and issue an alarm based on the target alarm data.

[0054] In the alarm system of this application, the change data (including historical change data, first change data, and second change data) here represent the change work order data. The change work order data is obtained from the process platform through an API or a database interface, and it stores detailed information related to each change. In order to accurately capture the change records, the system needs to regularly pull the latest change work order from the registration center. These work order information usually contains multiple structured fields, such as change classification, product information, change personnel, and IP or network related information. The change classification field is used to describe the type of change, which may involve multiple operations such as code updates, configuration modifications, and network topology changes. The product information identifies the specific service modules or system components affected by the change, helping operation and maintenance personnel to quickly locate the scope of the change. The IP or network information field records the specific IP address segment or network subnet information affected by the change, thereby helping the system to accurately associate the connection between the change and the specific network environment. The above data usually uses a structured data format of JSON or XML to ensure its standardization and readability during transmission and storage.

[0055] In order to store and manage change order data, a dedicated database table needs to be designed (see Table 1). The table should contain enough fields to record the detailed information of each change operation and support efficient data query and update operations. The specific field design can be adjusted and optimized according to actual needs. For example, it can include fields such as change ID, change type, product information, change personnel, IP address or network related information. At the same time, in order to ensure the integrity and consistency of the data, it is also necessary to implement corresponding data storage and update mechanisms (such as transaction processing, concurrency control, etc.).

[0056] Table 1 Work Order Table

[0057]

[0058]

[0059] In order to deeply analyze the relationship between changes and alarms, in addition to the change work order data, other information related to the change needs to be obtained. This information includes IP addresses, product information, application information, and product information, which together constitute the complete dimension of change analysis. The data acquisition method is similar to that of work order data.

[0060] Alarm data is data that already exists in the alarm platform. It has been cleaned and organized. One piece of data corresponds to one alarm. The alarm data comes from various monitoring systems and is collected and summarized by the system. See Table 2:

[0061] Table 2 Alarm data table

[0062]

[0063]

[0064] Each piece of the alarm data is processed in a closed loop. After the alarm occurs, it will be sent to the team or responsible personnel for manual labeling. If the alarm is caused by a change, the label in the change will be selected. This is the is_change in the alarm data set to true. The correlation between the alarm and the change will be judged based on this field later. The data collection module collects data through incremental updates through scheduled tasks, collecting current data every 2 minutes to ensure the timeliness of the data.

[0065] Model of intelligent judgment module: This application adopts KNN algorithm for training. First of all, the cleaning and screening of original data are crucial. In this step, this application will carefully check and delete those records with missing or invalid key fields to ensure the accuracy and validity of the data. For example, if some records in the alarm data table or change record table lack key information such as alarm time, change time or team information, these records will be eliminated to avoid interference with subsequent analysis. Afterwards, in order to be able to carry out model training, since the historical change data includes multiple first sub-data, and the historical alarm data includes multiple second sub-data, it is necessary to merge the historical change data and the historical alarm data according to the correlation between the first sub-data and the second sub-data to obtain historical combined data. Specifically, this application merges the data of the alarm data table and the change record table according to the alarm time and team information fields, and obtains the detailed information required for the corresponding IP, network, product and application data. The purpose of this step is to match the related records in the two tables to form a complete data set to meet the needs of KNN algorithm training. The merged data set will contain all necessary information for alarm and change operations, providing a basis for subsequent feature selection and model training.

[0066] After data preprocessing and merging are completed, this application will perform feature selection. In this step, this application will select appropriate feature fields as inputs to the KNN algorithm based on business needs and data characteristics. For example, this application can select alarm time, change type, product information, alarm level, IP and network area as feature variables. These feature fields can fully reflect the correlation between alarms and change operations, which is crucial for model training.

[0067] Subsequently, this application will standardize the data. Since the dimensions and ranges of different feature fields may be different, directly using the original data for KNN algorithm training may lead to deviation in the results. Therefore, this application will use methods such as Z-score standardization or Min-Max standardization to unify the dimensions of all feature fields into the same range to eliminate the impact of dimension differences on algorithm performance. After completing the standardization process, this application divides the data set into a training set and a test set. The training set is used to train the KNN model, while the test set is used to evaluate the performance of the model. When dividing the data set, this application will ensure the randomness and independence of the data to avoid overfitting or underfitting. Using the training set to train the KNN model is the most core step in the whole process. In this step, this application will select a suitable distance metric (such as Euclidean distance, Manhattan distance, etc.) and K value (number of neighbors). Then, traverse each record in the training set, calculate the distance between it and the sample point to be classified, and select the nearest K neighbors based on the distance sorting result. Finally, the category of the sample point to be classified is predicted by majority voting and other methods based on the category information of these K neighbors.

[0068] In order to find the optimal K value and distance measurement method, this application will use cross-validation and other methods to tune the model. Cross-validation evaluates the performance of the model by dividing the data set into multiple subsets and repeatedly using different subsets as training sets and validation sets. By comparing the model performance indicators (such as accuracy, recall rate, etc.) under different parameter combinations, this application can find the optimal parameter settings. The above are the detailed steps when this application uses the KNN algorithm for training. Although this process is complicated, each step is necessary, and they together ensure the accuracy and reliability of the model.

[0069] After the model training is completed, this application uses the test set to evaluate the model and verify its performance. Finally, this application applies the trained KNN model to the classification or prediction of actual alarm data, automatically identifies alarms related to change operations, calculates the probability that the current alarm is from the change after the alarm occurs, and determines the correlation between the alarm and the change based on the probability size and the set threshold. In addition, this application also regularly updates the data set according to the model application situation to further optimize the model performance.

[0070] In modern enterprise IT operation and maintenance management, efficient processing of alarm information is crucial. When an alarm occurs, the probability that the alarm is caused by the current change activity can be evaluated through intelligent algorithms. Once this probability reaches the preset threshold, the system will perform alarm noise reduction processing according to the pre-defined strategy. The traditional approach is to push information to the alarm manager and the team's alarm notification group immediately after the alarm occurs. Although this method can ensure a quick response, it is also easy to cause an alarm storm and interfere with normal operation and maintenance work.

[0071] After adopting the intelligent judgment mechanism, if the first change data is a normal alarm, an alarm is issued based on the first alarm data. If the first change data is a related alarm, the first alarm data is sent to the alarm noise reduction module. For those alarms that are considered to be caused by change operations, the alarm noise reduction module system will choose to delay sending instead of immediately notifying all relevant personnel. Specifically, every ten minutes, the system will summarize all alarms that are determined to be change-related during this period, and compress them into a comprehensive alarm message, and only notify the personnel directly responsible for the change operation. The advantage of doing this is that, on the one hand, it reduces the information overload of non-directly responsible personnel and avoids unnecessary interference; on the other hand, change operators can concentrate on handling alarms that are directly related to their work, improving the pertinence and efficiency of processing.

[0072] In addition, you can also choose to downgrade the alarm caused by the change, that is, lower its priority so that it will not immediately attract the attention of all people like the high-priority system abnormality alarm. This strategy also helps the operation and maintenance team to better allocate resources and ensure that they can quickly respond to serious problems that really affect business continuity. Through the above measures, not only can the pressure on operation and maintenance personnel be reduced, but also the overall operation and maintenance quality and system stability can be improved to ensure that key tasks are not affected.

[0073] The alarm system in the present application can also continuously learn and improve the accuracy of the alarm during use. That is, the intelligent judgment module is also used to train a new alarm model using the historical change data and the historical alarm data, the first change data and the first alarm data;

[0074] The change data collection module is used to sequentially obtain the second change data of the monitoring system and send the second change data to the intelligent judgment module;

[0075] The intelligent judgment module is used to judge each of the second change data by using the new alarm model to obtain second alarm data, and send the second alarm data to the alarm noise reduction module;

[0076] The alarm noise reduction module is used to process the plurality of second alarm data to obtain processed new alarm data, and issue an alarm based on the new alarm data.

[0077] That is to say, after judging the first change data, the alarm system in the present application trains the target alarm model again with the first change data and the corresponding first alarm data, the historical change data and the historical alarm data to obtain a new alarm module. The new alarm module is used to judge the first change data next time.

[0078] The method proposed in this application uses the K-nearest neighbor (KNN) algorithm to analyze historical alarm data and change records to identify potential associations between alarms and change operations, thereby automatically distinguishing alarms caused by changes from true system abnormality alarms. This method not only simplifies configuration requirements and reduces the risk of inaccurate alarm processing due to manual configuration errors, but also, due to the characteristics of the algorithm itself, can achieve real-time alarm processing and improve the effectiveness and timeliness of alarm information. In addition, this method improves operation and maintenance efficiency by reducing the workload of operation and maintenance personnel in handling invalid or duplicate alarms, and helps to enhance the stability and reliability of the system. It has good versatility and scalability and is suitable for a variety of change operations and alarm environments.

[0079] Figure 3 A flow chart of an alarm method provided by an embodiment of the present application is shown, which is applied to an alarm system, wherein the alarm system comprises: a change data collection module, an intelligent judgment module and an alarm noise reduction module, wherein the change data collection module is connected to a monitoring system and a process platform, wherein the change data collection module is connected to the intelligent judgment module, and wherein the intelligent judgment module is connected to the alarm noise reduction module, wherein the method comprises steps S101-S104; specifically:

[0080] S101, the change data collection module obtains the historical change data and the corresponding historical alarm data of the monitoring system and the process platform, and sends the historical change data and the historical alarm data to the intelligent judgment module;

[0081] S102, the intelligent judgment module uses the historical change data and the historical alarm data to train a target alarm model;

[0082] S103, the change data collection module sequentially obtains first change data of the monitoring system, and sends the first change data to the intelligent judgment module;

[0083] S104, the intelligent judgment module judges each of the first change data by using the target alarm model to obtain first alarm data, and sends the first alarm data to the alarm noise reduction module;

[0084] S105. The alarm noise reduction module processes the plurality of first alarm data to obtain processed target alarm data, and issues an alarm based on the target alarm data.

[0085] The method further comprises:

[0086] The intelligent judgment module uses the historical change data and the historical alarm data, the first change data and the first alarm data to train a new alarm model;

[0087] The change data collection module sequentially obtains the second change data of the monitoring system, and sends the second change data to the intelligent judgment module;

[0088] The intelligent judgment module judges each of the second change data by using the new alarm model to obtain second alarm data, and sends the second alarm data to the alarm noise reduction module;

[0089] The alarm noise reduction module processes the plurality of the second alarm data to obtain processed new alarm data, and issues an alarm based on the new alarm data.

[0090] The intelligent judgment module judges each of the first change data using the target alarm model to obtain first alarm data, and sends the first alarm data to the alarm noise reduction module, including:

[0091] Using the target alarm model to process each of the first change data, to obtain an alarm type and first alarm data of the first change data;

[0092] If the first change data is an associated alarm, the first alarm data is sent to the alarm noise reduction module.

[0093] The intelligent judgment module is further configured to generate an alarm based on the first alarm data if the first change data is a normal alarm.

[0094] The alarm noise reduction module processes the plurality of the first alarm data to obtain processed target alarm data, and issues an alarm according to the target alarm data, including:

[0095] The target alarm data is obtained by compressing the plurality of the first alarm data or changing the alarm level of the first alarm data, and an alarm is issued according to the target alarm data.

[0096] The historical change data includes a plurality of first sub-data, and the historical alarm data includes a plurality of second sub-data;

[0097] The intelligent judgment module uses the historical change data and the historical alarm data to train a target alarm model, including:

[0098] According to the correlation between the first sub-data and the second sub-data, the historical change data and the historical alarm data are combined to obtain historical combination data;

[0099] A target warning model is obtained by training using the target feature field in the historical combined data.

[0100] The target alarm model is a KNN algorithm model.

[0101] like Figure 4 As shown, an embodiment of the present application provides an electronic device for executing the alarm method in the present application, the device includes a memory, a processor, a bus, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the alarm method when executing the computer program.

[0102] Specifically, the above-mentioned memory and processor may be general-purpose memory and processor, which are not specifically limited here. When the processor runs the computer program stored in the memory, the above-mentioned alarm method can be executed.

[0103] Corresponding to the alarm method in the present application, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned alarm method are executed.

[0104] Specifically, the storage medium can be a general storage medium, such as a mobile disk, a hard disk, etc. When the computer program on the storage medium is executed, the above-mentioned alarm method can be executed.

[0105] In the embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. The system embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0106] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, and may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0107] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0108] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0109] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0110] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An alarm system, characterized in that: The alarm system includes: a change data collection module, an intelligent judgment module and an alarm noise reduction module, wherein the change data collection module is connected to the monitoring system and the process platform, the change data collection module is connected to the intelligent judgment module, and the intelligent judgment module is connected to the alarm noise reduction module; The change data collection module is used to obtain the historical change data and corresponding historical alarm data of the monitoring system and process platform, and send the historical change data and the historical alarm data to the intelligent judgment module; The intelligent judgment module is used to train a target alarm model using the historical change data and the historical alarm data; The change data collection module is used to sequentially obtain the first change data of the monitoring system and send the first change data to the intelligent judgment module; The intelligent judgment module is used to judge each of the first change data using the target alarm model to obtain first alarm data, and send the first alarm data to the alarm noise reduction module; The alarm noise reduction module is used to process the plurality of the first alarm data to obtain processed target alarm data, and issue an alarm based on the target alarm data.

2. The system according to claim 1, characterized in that The intelligent judgment module is further used to train a new alarm model using the historical change data and the historical alarm data, the first change data and the first alarm data; The change data collection module is used to sequentially obtain the second change data of the monitoring system and send the second change data to the intelligent judgment module; The intelligent judgment module is used to judge each of the second change data by using the new alarm model to obtain second alarm data, and send the second alarm data to the alarm noise reduction module; The alarm noise reduction module is used to process the plurality of the second alarm data to obtain new alarm data after processing, and issue an alarm based on the new alarm data.

3. The system according to claim 1, characterized in that The intelligent judgment module is used to judge each of the first change data using the target alarm model to obtain first alarm data, and send the first alarm data to the alarm noise reduction module, including: Using the target alarm model to process each of the first change data, to obtain an alarm type and first alarm data of the first change data; If the first change data is an associated alarm, the first alarm data is sent to the alarm noise reduction module.

4. The system according to claim 3, characterized in that The intelligent judgment module is further configured to generate an alarm based on the first alarm data if the first change data is a normal alarm.

5. The system according to claim 3, characterized in that The alarm noise reduction module is used to process the plurality of the first alarm data to obtain processed target alarm data, and issue an alarm according to the target alarm data, including: The target alarm data is obtained by compressing the plurality of the first alarm data or changing the alarm level of the first alarm data, and an alarm is issued according to the target alarm data.

6. The system according to claim 1, characterized in that The historical change data includes a plurality of first sub-data, and the historical alarm data includes a plurality of second sub-data; The intelligent judgment module is used to train a target alarm model using the historical change data and the historical alarm data, including: According to the correlation between the first sub-data and the second sub-data, the historical change data and the historical alarm data are combined to obtain historical combination data; A target warning model is obtained by training using the target feature field in the historical combined data.

7. The system according to claim 1 or 6, characterized in that: The target alarm model is a KNN algorithm model.

8. An alarm method, characterized in that: Applied to an alarm system, the alarm system includes: a change data collection module, an intelligent judgment module and an alarm noise reduction module, the change data collection module is connected to a monitoring system and a process platform, the change data collection module is connected to the intelligent judgment module, the intelligent judgment module is connected to the alarm noise reduction module, and the method includes: The change data collection module obtains the historical change data and corresponding historical alarm data of the monitoring system and process platform, and sends the historical change data and the historical alarm data to the intelligent judgment module; The intelligent judgment module uses the historical change data and the historical alarm data to train a target alarm model; The change data collection module sequentially obtains the first change data of the monitoring system, and sends the first change data to the intelligent judgment module; The intelligent judgment module judges each of the first change data by using the target alarm model to obtain first alarm data, and sends the first alarm data to the alarm noise reduction module; The alarm noise reduction module processes the plurality of the first alarm data to obtain processed target alarm data, and issues an alarm based on the target alarm data.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the alarm method as described in claim 8 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the alarm method as claimed in claim 8 are executed.

Images