Alarm data processing method and device, storage medium and electronic equipment
By using graph convolutional neural network in the alarm monitoring platform to establish an alarm classification model, automatically process alarm data, and obtain alarm classification and disposal solutions, the problem of low alarm response efficiency in the existing technology is solved, and more efficient operation and maintenance and alarm processing are achieved.
Patent Information
- Application Number
- CN202311093090.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-28
- Publication Date
- 2025-02-28
AI Technical Summary
In the prior art, alarm response efficiency depends on the experience of R&D personnel, resulting in low operation and maintenance efficiency.
By pre-establishing an alarm classification model based on the graph convolution neural network, the alarm data is input to the model to obtain the alarm classification, and the preset alarm handling plan is obtained, and the R&D personnel's client is pushed.
Improve operation and maintenance efficiency and alarm response speed, and reduce the processing time of R&D personnel on alarm data.
Smart Images
Figure CN119537123A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of alarm technology, and in particular to an alarm data processing method and device, a storage medium and an electronic device. Background Art
[0002] At present, most companies have one or more alarm monitoring platforms, which are used to detect business systems. When an abnormality occurs in the business system, the abnormal data generated by the business system, namely the alarm data, is obtained, and alarms are pushed based on the alarm data.
[0003] In the prior art, after receiving the alarm data, R&D personnel rely on their own experience to respond to the alarm, that is, to operate and maintain the business system. However, due to different work experience and familiarity with the business system, different R&D personnel have different response speeds to the same alarm, that is, there is a problem of low operation and maintenance efficiency. Summary of the invention
[0004] The present application provides an alarm data processing method and device, a storage medium and an electronic device, aiming to solve the problem in the prior art that the alarm response efficiency depends on the experience of R&D personnel, resulting in low alarm effect efficiency.
[0005] In order to achieve the above objectives, this application provides the following technical solutions:
[0006] A method for processing alarm data, comprising:
[0007] Obtain alarm data generated by the business system;
[0008] Inputting the alarm data into an alarm classification model to obtain the alarm classification to which the alarm data belongs; the alarm classification model is pre-established based on a graph convolutional neural network;
[0009] Obtaining a preset alarm handling plan corresponding to the alarm classification;
[0010] The alarm data and the alarm handling plan are pushed to the client to which the R&D personnel belong.
[0011] Optionally, in the above method, the step of pushing the alarm data and the alarm handling solution to the client to which the developer belongs includes:
[0012] Determine whether the alarm handling plan meets the alarm push rules;
[0013] If the alarm push rule is met, the alarm data and the alarm handling plan are pushed to the client to which the R&D personnel belong.
[0014] In the above method, optionally, the step of inputting the alarm data into an alarm classification model to obtain the alarm classification to which the alarm data belongs includes:
[0015] Performing vectorization processing on the alarm data to obtain a feature representation of the alarm data;
[0016] The application program interface API of the alarm classification model is called, and the feature representation of the alarm data is input into the alarm classification model to obtain the alarm classification to which the alarm data belongs.
[0017] In the above method, optionally, the process of pre-establishing an alarm classification model based on a graph convolutional neural network includes:
[0018] Acquire an alarm data sample set; the alarm data sample set includes a plurality of alarm data samples;
[0019] Selecting an alarm data sample from the alarm data sample set as a target sample;
[0020] Based on the target sample, calculating an aggregate feature vector of a sampling node and an aggregate feature vector of a first node in a graph convolutional neural network; the first node is a neighbor node of the sampling node;
[0021] Calculating the loss function of the graph convolutional neural network based on the aggregated feature vector of the sampling node and the aggregated feature vector of the first node to obtain a new loss function;
[0022] Based on the new loss function, training the graph convolutional neural network to obtain a new graph convolutional neural network;
[0023] Determine whether the alarm data sample set includes unselected alarm data samples, and if so, select an alarm data sample from the unselected alarm data samples included in the alarm data sample set as a new target sample;
[0024] Based on the new target sample, the new loss function, and the new graph convolutional neural network, return to execute the step of calculating the aggregated feature vector of the first node and the aggregated feature vector of the sampling node in the graph convolutional neural network based on the target sample, until the alarm data sample set does not contain unselected alarm data samples, and use the current graph convolutional neural network as an alarm classification model.
[0025] In the above method, optionally, the step of calculating the aggregate feature vector of the sampling node and the aggregate feature vector of the first node in the graph convolutional neural network based on the target sample includes:
[0026] Performing vectorization processing on the target sample to obtain an initial feature representation of the target sample;
[0027] Determining the special characters included in the target sample;
[0028] According to preset weights, weighted processing is performed on the vectors of special characters included in the target sample to obtain a weighted result;
[0029] Calculating a target feature representation of the target sample based on the initial feature representation and the weighted result;
[0030] Based on the target feature representation of the target sample, calculating the aggregation information of the sampling nodes and the aggregation information of the first node in each layer of the network structure included in the graph convolutional neural network;
[0031] Based on each aggregation information of the sampling node, calculating the aggregation feature vector of the sampling node;
[0032] Based on each aggregation information of the first node, an aggregation feature vector of the first node is calculated.
[0033] In the above method, optionally, the graph convolutional neural network includes a two-layer network structure.
[0034] The above method, optionally, after pushing the alarm data and the alarm handling solution to the client to which the target object belongs, further comprises:
[0035] Obtaining an input optimization plan for the alarm handling plan;
[0036] Determining a target alarm classification corresponding to the optimization scheme;
[0037] Based on the alarm data and the target alarm classification, the alarm classification model is optimized.
[0038] An alarm data processing device, comprising:
[0039] A first acquisition unit, used to acquire alarm data generated by the business system;
[0040] An input unit, used to input the alarm data into an alarm classification model to obtain the alarm classification to which the alarm data belongs; the alarm classification model is pre-established based on a graph convolutional neural network;
[0041] A second acquisition unit, used to acquire a preset alarm handling solution corresponding to the alarm classification;
[0042] The push unit is used to push the alarm data and the alarm handling solution to the client to which the R&D personnel belong.
[0043] A storage medium stores an instruction set, wherein the instruction set implements the above-mentioned alarm data processing method when executed by a processor.
[0044] An electronic device, comprising:
[0045] A memory for storing at least one set of instructions;
[0046] The processor is used to execute the instruction set stored in the memory, and implement the alarm data processing method as mentioned above by executing the instruction set.
[0047] Compared with the prior art, this application has the following advantages:
[0048] The present application provides an alarm data processing method and device, storage medium and electronic device. The method obtains an alarm classification model based on a graph convolutional neural network in advance, so that when the alarm data generated by the business system is obtained, the alarm data is input into the alarm classification model to obtain the alarm classification to which the alarm data belongs, and then the preset alarm handling plan corresponding to the alarm classification is obtained, and finally the alarm data and the alarm handling plan are pushed to the client to which the R&D personnel belong. It can be seen that the present application scheme, by determining the alarm handling plan, pushes the alarm handling plan to the client to which the R&D personnel belong, so that the R&D personnel can directly operate and maintain the business system based on the alarm handling plan, thereby improving the operation and maintenance efficiency and the alarm response speed. BRIEF DESCRIPTION OF THE DRAWINGS
[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0050] Figure 1 A method flow chart of an alarm data processing method provided by this application;
[0051] Figure 2 Another method flow chart of an alarm data processing method provided by the present application;
[0052] Figure 3 An accuracy trend chart of an alarm data processing method provided in this application;
[0053] Figure 4 A recall rate trend chart of an alarm data processing method provided in this application;
[0054] Figure 5Another method flow chart of an alarm data processing method provided by the present application;
[0055] Figure 6 An example diagram of an alarm data processing method provided in this application;
[0056] Figure 7 A schematic diagram of the structure of an alarm data processing device provided by the present application;
[0057] Figure 8 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION
[0058] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0059] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.
[0060] It should be noted that the concepts such as "first" and "second" mentioned in the present application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.
[0061] It should be noted that the modifications of "one" and "plurality" mentioned in the disclosure of this application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".
[0062] The present application can be used in many general or special computing device environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multi-processor devices, distributed computing environments including any of the above devices or equipment, etc.
[0063] The present application embodiment provides an alarm data processing method, which can be applied to an alarm monitoring platform. The method flow chart of the method is as follows: Figure 1 As shown, specifically including:
[0064] S101. Acquire alarm data generated by a business system.
[0065] In this embodiment, when an abnormality occurs in the business system, alarm data generated by the business system is obtained.
[0066] It should be noted that the present application does not limit the data format of the alarm data, and the form of the alarm data includes but is not limited to text form and / or voice form.
[0067] S102: Input the alarm data into an alarm classification model to obtain the alarm classification to which the alarm data belongs.
[0068] The inventors have found that there are some similar alarms in the business system that can be summarized. For example, site query errors or site non-existence errors can be solved by redoing the database snapshot in most cases; and connection timeout errors such as port blockage and network ACL (Access Control List) blockage can be quickly solved by contacting R&D personnel for investigation, without the need for R&D personnel to spend time locating them one by one.
[0069] The similarity between alarm data is learnable. Based on this, it is proposed to use graph convolutional neural network to learn the similarity between alarm data to aggregate similarity features.
[0070] In this embodiment, an alarm classification model is established in advance based on a graph convolutional neural network, by abstracting similar alarms into nodes in a graph and using edges to represent similar relationships between nodes.
[0071] See also Figure 2 The process of pre-establishing an alarm classification model based on a graph convolutional neural network specifically includes the following steps:
[0072] S201. Obtain a set of alarm data samples.
[0073] In this embodiment, an alarm data sample set is obtained, wherein the alarm data sample set includes a plurality of alarm data samples, and the alarm data samples are historical alarm data generated by the business system.
[0074] S202: Select an alarm data sample from the alarm data sample set as a target sample.
[0075] In this embodiment, an alarm data sample is randomly selected from the alarm data sample set as a target sample.
[0076] S203. Based on the target sample, calculate the aggregate feature vector of the sampling node and the aggregate feature vector of the first node in the graph convolutional neural network.
[0077] In this embodiment, based on the selected target sample, the aggregate feature vector of the sampling node and the aggregate feature vector of the first node in the graph convolutional neural network are calculated, wherein the sampling node is the graph convolutional neural network sampling node and the first node is the neighbor node of the sampling node.
[0078] The process of calculating the aggregate feature vector of the sampling node and the aggregate feature vector of each first node in the graph convolutional neural network includes the following steps:
[0079] Vectorize the target sample to obtain the initial feature representation of the target sample;
[0080] Determine the special characters contained in the target sample;
[0081] According to preset weights, weighted processing is performed on the vectors of special characters included in the target sample to obtain a weighted result;
[0082] Based on the initial feature representation and the weighted result, the target feature representation of the target sample is calculated;
[0083] Based on the target feature representation of the target sample, the aggregation information of the sampling nodes and the aggregation information of the first node in each layer of the network structure included in the graph convolutional neural network are calculated;
[0084] Based on each aggregation information of the sampling node, the aggregation feature vector of the sampling node is calculated;
[0085] Based on the respective aggregation information of the first node, an aggregation feature vector of the first node is calculated.
[0086] In this embodiment, the target sample is vectorized to obtain an initial feature representation of the target sample, and special characters included in the target sample are determined. Exemplarily, the special characters may be punctuation marks and words representing faults, such as delay, retry, exception, and timeout.
[0087] In this embodiment, the vectors of the special characters included in the target sample are weighted according to the preset weights to obtain a weighted result. For example, the preset weight is w, and the weighted result = w﹒ vector of the special character. It should be noted that by weighting the vectors of the special characters, it is achieved to give the special characters higher attention than other characters.
[0088] In this embodiment, based on the initial feature representation and the weighted result, the target feature representation of the target sample is calculated. Specifically, the initial feature identifier and the weighted result are summed to obtain the target feature representation of the target sample.
[0089] In this embodiment, based on the target feature representation of the target sample, the aggregation information of the sampling nodes and the aggregation information of each first node in each layer of the network structure included in the calculation graph convolutional neural network are calculated.
[0090] In this embodiment, based on the aggregation information of each sampling node, the aggregation feature vector of the sampling node is calculated, that is, based on the aggregation information of the sampling nodes in each layer of the network structure, the aggregation feature vector of the sampling node is calculated. Optionally, the aggregation feature vector of the sampling node can be calculated using Z v express.
[0091] In this embodiment, based on each aggregation information of the first node, the aggregation feature vector of the first node is calculated. Specifically, based on the aggregation information of the first node in each layer of the network structure, the aggregation feature vector of the first node is calculated. Optionally, the aggregation feature vector of the first node can be calculated using Z u express.
[0092] Among them, the graph convolutional neural network includes a multi-layer network structure, and preferably, the multi-layer network structure includes a two-layer network structure. In other words, the graph convolutional neural network is a two-dimensional graph convolutional neural network. The inventors have found that traditional temporal neural network models focus more on the similarity of syntax and semantics, and are not good at long-term memory. Such models often ignore the similarity between different alarms in the context of large sections of alarm text, and the edges of the graph convolutional neural network can contain this part of structural information. Secondly, the use of a two-dimensional graph convolutional neural network instead of a higher dimension is due to engineering practice considerations. Two dimensions can generalize the relationship between entities in most scenarios. While higher dimensions exponentially increase the amount of training, the model's generalization ability will not be significantly improved.
[0093] S204. Based on the aggregated feature vector of the sampling node and the aggregated feature vector of the first node, calculate the loss function of the graph convolutional neural network to obtain a new loss function.
[0094] The aggregated feature vector of the sampling node and the aggregated feature vector of the first node are substituted into the loss function of the graph convolutional neural network to obtain a new loss function.
[0095] Preferably, the loss function of the graph convolutional neural network can be:
[0096]
[0097] Among them, Z v represents the aggregate feature vector of node v, Z u represents the aggregate feature vector of node u, It represents the mathematical expectation of the loss function, Q is a fixed value, and is the sample size of the alarm data sample.
[0098] S205. Based on the new loss function, the graph convolutional neural network is trained to obtain a new graph convolutional neural network.
[0099] In this embodiment, the graph convolutional neural network is trained based on the new loss function to optimize the model parameters of the graph convolutional neural network, thereby obtaining a new graph convolutional neural network.
[0100] S206 , determining whether the alarm data sample set contains unselected alarm data samples, if so, executing S207 , if not, executing S208 .
[0101] In this embodiment, it is determined whether the alarm data sample set includes unselected alarm data samples, that is, it is determined whether there are alarm data samples that are not used to calculate the aggregated feature vector.
[0102] S207. Select an alarm data sample from the unselected alarm data samples included in the alarm data sample set as a new target sample, and return to execute 203 based on the new target sample, the new loss function, and the new graph convolutional neural network.
[0103] In this embodiment, if the alarm data sample set includes unselected alarm data samples, an alarm data sample is selected from the unselected alarm data samples included in the alarm data sample set as a new target sample.
[0104] After selecting a new target sample, based on the new target sample, the new loss function, and the new graph convolutional neural network, return to step S203 to perform a new round of training on the graph convolutional neural network to minimize the loss function.
[0105] S208. Use the current graph convolutional neural network as an alarm classification model.
[0106] In this embodiment, if the alarm data sample set does not include unselected alarm data samples, it means that the training of the graph convolutional neural network has been completed, and the current graph convolutional neural network is used as an alarm classification model.
[0107] It should be noted that the alarm classification model can be regarded as a multi-classification model, and the alarm classification includes but is not limited to delay-related faults, job-level failure faults, and machine-related failure faults (operation and maintenance operations).
[0108] The inventor of the present application recorded the training iteration process and the testing process of the alarm classification model and obtained the accuracy trend chart of the alarm classification model as shown in the figure: Figure 3 As shown, Figure 3 The darker line in the figure is the accuracy trend of the test iteration process, that is, the accuracy trend of train, and the lighter line is the accuracy trend of the test process, that is, the accuracy of test. It can be seen that the accuracy of training and testing is getting higher and higher.
[0109] The inventor of the present application recorded the training iteration process and the testing process of the alarm classification model and obtained the recall rate trend chart of the alarm classification model as shown in the figure: Figure 4 As shown, Figure 4 The darker line in the figure is the recall rate trend of the test iteration process, that is, the recall rate trend of train, and the lighter line is the recall rate trend of the test process, that is, the recall rate of test. It can be seen that due to the mutual restriction between precision and recall, the recall rates of training and testing tend to a lower value, among which the recall rate trend of the test process tends to 0.5, and the recall rate trend of the training process tends to 0.25.
[0110] In this embodiment, the alarm data is input into the alarm classification model, and the alarm classification model performs aggregation processing on the alarm data to achieve clustering of similar alarm data according to the alarm classification to which the alarm data belongs.
[0111] In this embodiment, the process of inputting alarm data into the alarm handling model to obtain the alarm classification to which the alarm data belongs specifically includes the following steps:
[0112] Perform vectorization processing on the alarm data to obtain the feature representation of the alarm data;
[0113] The application program interface API of the alarm classification model is called, and the feature representation of the alarm data is input into the alarm classification model to obtain the alarm classification to which the alarm data belongs.
[0114] In this embodiment, an application programming interface API of the alarm classification model is provided.
[0115] In this embodiment, the alarm data is first vectorized to obtain a feature representation of the alarm data, and then the application program interface API of the alarm classification model is called to input the feature representation of the alarm data into the alarm classification model to obtain the alarm classification to which the alarm data belongs.
[0116] S103: Obtain a preset alarm handling plan corresponding to the alarm classification.
[0117] In this embodiment, an alarm handling plan corresponding to each alarm category is preset.
[0118] In this embodiment, after the alarm category to which the alarm data belongs is acquired, an alarm handling solution corresponding to the alarm category may be determined from preset alarm handling solutions.
[0119] S104: Push the alarm data and alarm handling plan to the client to which the R&D personnel belong.
[0120] In this embodiment, the alarm data and the alarm handling plan are pushed to the client to which the R&D personnel belong. Specifically, it is determined whether the alarm handling plan meets the preset alarm push rules. If the alarm push rules are not met, the alarm data and the alarm handling plan will not be pushed. If the alarm rules are met, the alarm data and the alarm handling plan will be pushed to the client to which the R&D personnel belong. In this way, the R&D personnel can quickly handle exceptions in the business system based on the alarm handling plan, shorten the operation and maintenance time, and thus improve the operation and maintenance efficiency.
[0121] It should be noted that the alarm push rules can be adjusted according to needs.
[0122] For example, for the alarm data "Wasp-Job ID: 68660, Job Name: Foreign Order Database, Cluster Name: Test Cluster, Delayed for 20467 seconds, Alarm Time: Tue Apr 12 17:10:00 CST 2022" generated by the business system, after being processed by the alarm classification model, the output alarm classification is a single-task delay alarm, and the alarm handling plan corresponding to the alarm classification is determined as follows:
[0123] 1. Check whether there is a backlog in target writes;
[0124] 2. Check whether there is any delay in the vehicle data source;
[0125] 3. Check whether any binary logs have been generated in the recent period.
[0126] The present application provides an alarm data processing method, which obtains an alarm classification model based on a graph convolutional neural network in advance, and then inputs the alarm data into the alarm classification model to obtain the alarm classification to which the alarm data belongs, and then obtains the preset alarm handling plan corresponding to the alarm classification, and finally pushes the alarm data and the alarm handling plan to the client to which the R&D personnel belong. It can be seen that the present application scheme, by determining the alarm handling plan, pushes the alarm handling plan to the client to which the R&D personnel belong, so that the R&D personnel can directly operate and maintain the business system based on the alarm handling plan, thereby improving the operation and maintenance efficiency and alarm response speed.
[0127] See also Figure 5 In the alarm data processing method provided in the embodiment of the present application, after step S104, the following steps may also be included:
[0128] S501. Obtain an input optimization plan for an alarm handling plan.
[0129] In this embodiment, the R&D personnel can also determine an optimization plan for the alarm data based on the alarm handling plan and their own experience, and perform exception handling on the business system based on the optimization plan.
[0130] In this embodiment, when the R&D personnel use the optimization plan to handle the exception of the business system, the input optimization plan for the alarm handling plan is received.
[0131] S502: Determine the target alarm category corresponding to the optimization solution.
[0132] In this embodiment, the target alarm category corresponding to the optimization scheme is determined, that is, the alarm category corresponding to the optimization scheme is determined, and the alarm category corresponding to the optimization scheme is determined as the target alarm category. Specifically, the optimization scheme is structured, and based on the optimization scheme after structured processing, the target alarm category corresponding to the optimization scheme is determined.
[0133] S503: Optimize the alarm classification model based on the alarm data and the target alarm classification.
[0134] In this embodiment, the alarm classification model is optimized based on the alarm data and the target alarm classification, that is, the alarm classification model is optimized in a supervised manner, thereby continuously improving the accuracy of the alarm classification model.
[0135] Specifically, data preprocessing is performed on the alarm data and target alarm classification, and based on the alarm data and target alarm classification after data preprocessing, the alarm classification model is optimized. Optionally, the data preprocessing includes but is not limited to data cleaning, word segmentation processing, and vectorization processing.
[0136] Optionally, the embodiment of the present application may first store the alarm data and target alarm classification after data preprocessing into an alarm knowledge base, and then subsequently optimize the alarm classification model based on the alarm data and target alarm classification in the alarm knowledge base.
[0137] Optionally, the alarm classification model may be optimized based on historical alarm data and treatment plans corresponding to the historical alarm data.
[0138] In the alarm data processing method provided in the embodiment of the present application, by obtaining an input optimization plan for the alarm handling plan and determining the target alarm classification corresponding to the optimization plan, the alarm classification model is optimized based on the alarm data and the target alarm classification, thereby improving the accuracy of the alarm classification model.
[0139] See also Figure 6 The specific implementation process of the alarm data processing method provided in the above embodiment of the present application is illustrated as follows:
[0140] An alarm classification model is established in advance based on a graph convolutional neural network.
[0141] When an abnormality occurs in the business system and alarm data is generated, the alarm monitoring platform receives the input of the alarm data, that is, obtains the alarm data, and inputs the alarm data into the alarm classification model. The alarm classification model aggregates the alarm data and outputs the alarm category to which the alarm data belongs. Based on the alarm classification, the alarm handling plan corresponding to the alarm category is determined, and based on the alarm handling plan and configuration (that is, the alarm push rules mentioned above), it is determined whether to trigger the alarm notification. If the alarm notification is not triggered, the current process is terminated. If the alarm notification is triggered, the alarm data and the alarm handling plan are pushed to the client to which the R&D personnel belong, so that the R&D personnel can handle the exceptions of the business system according to the alarm handling plan to achieve rapid operation and maintenance.
[0142] When the R&D personnel handle the exception of the business system with the optimization plan, the input optimization plan for the alarm handling plan is received, wherein the optimization plan is a handling plan for the alarm data determined by the R&D personnel based on the alarm handling plan and combined with their own experience. The optimization plan is structured, and based on the structured optimization plan, the target alarm classification is determined, and the alarm data and the target alarm classification are preprocessed. The alarm data and the target alarm classification after data preprocessing are stored in the alarm knowledge base, and the alarm classification model is optimized based on the alarm data in the alarm knowledge base and the target alarm classification corresponding to the alarm data, so as to improve the accuracy of the alarm classification model.
[0143] Optionally, historical alarm data and treatment plans corresponding to the historical alarm data can also be obtained, and the historical alarm data and the target alarm classification corresponding to the historical alarm data can be preprocessed by determining the target alarm classification corresponding to the treatment plan corresponding to the historical alarm data, and the preprocessed data can be stored in an alarm knowledge base, and then the alarm classification model can be optimized based on the data in the alarm knowledge base to further improve the accuracy of the alarm classification model.
[0144] The alarm data processing method provided in the embodiment of the present application applies the powerful generalization ability of the graph convolutional neural network model in representing text semantic similarity to the prediction of similar alarm solutions of the monitoring platform, so that the monitoring platform outputs not only alarms but also solutions corresponding to the alarms, truly realizing "alarms are solutions" and improving the efficiency of operation and maintenance. In addition, the optimization plan is obtained by inputting an optimization plan for the alarm handling plan, and the target alarm category corresponding to the optimization plan is determined. Based on the alarm data and the target alarm category, the alarm classification model is optimized to achieve a closed loop, thereby improving the accuracy of the alarm classification model.
[0145] It should be noted that although the operations are depicted in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order. In certain circumstances, multitasking and parallel processing may be advantageous.
[0146] It should be understood that the various steps described in the method embodiments disclosed in the present application can be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.
[0147] and Figure 1 Corresponding to the method described above, the embodiment of the present application further provides an alarm data processing device for Figure 1 The specific implementation of the method is shown in the following diagram: Figure 7 As shown, specifically including:
[0148] The first acquisition unit 701 is used to acquire alarm data generated by the business system;
[0149] An input unit 702 is used to input the alarm data into an alarm classification model to obtain the alarm classification to which the alarm data belongs; the alarm classification model is pre-established based on a graph convolutional neural network;
[0150] The second acquisition unit 703 is used to acquire a preset alarm handling solution corresponding to the alarm classification;
[0151] The push unit 704 is used to push the alarm data and the alarm handling solution to the client to which the R&D personnel belong.
[0152] The alarm data processing device provided in the embodiment of the present application obtains an alarm classification model by pre-establishing it based on a graph convolutional neural network. When the alarm data generated by the business system is obtained, the alarm data is input into the alarm classification model to obtain the alarm classification to which the alarm data belongs, and then the preset alarm handling plan corresponding to the alarm classification is obtained, and finally the alarm data and the alarm handling plan are pushed to the client to which the R&D personnel belong. It can be seen that the present application scheme, by determining the alarm handling plan, pushes the alarm handling plan to the client to which the R&D personnel belong, so that the R&D personnel can directly operate and maintain the business system based on the alarm handling plan, thereby improving the operation and maintenance efficiency and the alarm response speed.
[0153] In one embodiment of the present application, based on the above solution, the push unit 704 is specifically configured to:
[0154] Determine whether the alarm handling plan meets the alarm push rules;
[0155] If the alarm push rule is met, the alarm data and the alarm handling plan are pushed to the client to which the R&D personnel belong.
[0156] In one embodiment of the present application, based on the above solution, the input unit 702 is specifically used to:
[0157] Acquire an alarm data sample set; the alarm data sample set includes a plurality of alarm data samples;
[0158] Selecting an alarm data sample from the alarm data sample set as a target sample;
[0159] Based on the target sample, calculating an aggregate feature vector of a sampling node in a graph convolutional neural network and an aggregate feature vector of a first node; the sampling node is a sampling node in the graph convolutional neural network, and the first node is a neighbor node of the sampling node;
[0160] Calculating the loss function of the graph convolutional neural network based on the aggregated feature vector of the sampling node and the aggregated feature vector of the first node to obtain a new loss function;
[0161] Based on the new loss function, training the graph convolutional neural network to obtain a new graph convolutional neural network;
[0162] Determine whether the alarm data sample set includes unselected alarm data samples, and if so, select an alarm data sample from the unselected alarm data samples included in the alarm data sample set as a new target sample;
[0163] Based on the new target sample, the new loss function, and the new graph convolutional neural network, return to execute the step of calculating the aggregated feature vector of the first node and the aggregated feature vector of the sampling node in the graph convolutional neural network based on the target sample, until the alarm data sample set does not contain unselected alarm data samples, and use the current graph convolutional neural network as an alarm classification model.
[0164] In one embodiment of the present application, based on the aforementioned solution, when the input unit 702 calculates the aggregate feature vector of the sampling node and the aggregate feature vector of the first node in the graph convolutional neural network based on the target sample, it is specifically used to:
[0165] In one embodiment of the present application, based on the above scheme, the target sample is vectorized to obtain an initial feature representation of the target sample;
[0166] Determining the special characters included in the target sample;
[0167] According to preset weights, weighted processing is performed on the vectors of special characters included in the target sample to obtain a weighted result;
[0168] Calculating a target feature representation of the target sample based on the initial feature representation and the weighted result;
[0169] Based on the target feature representation of the target sample, calculating the aggregation information of the sampling nodes and the aggregation information of the first node in each layer of the network structure included in the graph convolutional neural network;
[0170] Based on each aggregation information of the sampling node, calculating the aggregation feature vector of the sampling node;
[0171] Based on each aggregation information of the first node, an aggregation feature vector of the first node is calculated.
[0172] In one embodiment of the present application, based on the aforementioned scheme, the graph convolutional neural network includes a two-layer network structure.
[0173] In one embodiment of the present application, based on the above solution, it can also be configured as follows:
[0174] A third acquisition unit, used to acquire an input optimization solution for the alarm handling solution;
[0175] A determination unit, used to determine a target alarm category corresponding to the optimization scheme;
[0176] An optimization unit is used to optimize the alarm classification model based on the alarm data and the target alarm classification.
[0177] An embodiment of the present application further provides a storage medium, wherein the storage medium stores an instruction set, wherein when the instruction set is executed, the alarm data processing method disclosed in any of the above embodiments is executed.
[0178] The present application also provides an electronic device, whose structural diagram is as follows: Figure 8 As shown, it specifically includes a memory 801 for storing at least one set of instruction sets; a processor 802 for executing the instruction set stored in the memory, and implementing the alarm data processing method disclosed in any of the above embodiments by executing the instruction set.
[0179] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.
[0180] Although several specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope disclosed in the present application. Certain features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination.
[0181] The above description is only a preferred embodiment disclosed in this application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the disclosure of this application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the disclosure of this application (but not limited to) to form a technical solution.
Claims
1. A method for processing alarm data, characterized in that: include: Obtain alarm data generated by the business system; Inputting the alarm data into an alarm classification model to obtain the alarm classification to which the alarm data belongs; The alarm classification model is pre-established based on a graph convolutional neural network; Obtaining a preset alarm handling plan corresponding to the alarm classification; The alarm data and the alarm handling plan are pushed to the client to which the R&D personnel belong.
2. The method according to claim 1, characterized in that The step of pushing the alarm data and the alarm handling solution to the client to which the R&D personnel belong includes: Determine whether the alarm handling plan meets the alarm push rules; If the alarm push rule is met, the alarm data and the alarm handling plan are pushed to the client to which the R&D personnel belong.
3. The method according to claim 1, characterized in that The step of inputting the alarm data into an alarm classification model to obtain the alarm classification to which the alarm data belongs includes: Performing vectorization processing on the alarm data to obtain a feature representation of the alarm data; The application program interface API of the alarm classification model is called, and the feature representation of the alarm data is input into the alarm classification model to obtain the alarm classification to which the alarm data belongs.
4. The method according to claim 3, characterized in that: The process of pre-establishing an alarm classification model based on a graph convolutional neural network includes: Acquire an alarm data sample set; the alarm data sample set includes a plurality of alarm data samples; Selecting an alarm data sample from the alarm data sample set as a target sample; Based on the target sample, calculating an aggregate feature vector of a sampling node and an aggregate feature vector of a first node in a graph convolutional neural network; the first node is a neighbor node of the sampling node; Calculating the loss function of the graph convolutional neural network based on the aggregated feature vector of the sampling node and the aggregated feature vector of the first node to obtain a new loss function; Based on the new loss function, training the graph convolutional neural network to obtain a new graph convolutional neural network; Determine whether the alarm data sample set includes unselected alarm data samples, and if so, select an alarm data sample from the unselected alarm data samples included in the alarm data sample set as a new target sample; Based on the new target sample, the new loss function, and the new graph convolutional neural network, return to execute the step of calculating the aggregated feature vector of the first node and the aggregated feature vector of the sampling node in the graph convolutional neural network based on the target sample, until the alarm data sample set does not contain unselected alarm data samples, and use the current graph convolutional neural network as an alarm classification model.
5. The method according to claim 4, characterized in that The step of calculating, based on the target sample, an aggregate feature vector of a sampling node and an aggregate feature vector of a first node in a graph convolutional neural network includes: Performing vectorization processing on the target sample to obtain an initial feature representation of the target sample; Determining the special characters included in the target sample; According to preset weights, weighted processing is performed on the vectors of special characters included in the target sample to obtain a weighted result; Calculating a target feature representation of the target sample based on the initial feature representation and the weighted result; Based on the target feature representation of the target sample, calculating the aggregation information of the sampling nodes and the aggregation information of the first node in each layer of the network structure included in the graph convolutional neural network; Based on each aggregation information of the sampling node, calculating the aggregation feature vector of the sampling node; Based on each aggregation information of the first node, an aggregation feature vector of the first node is calculated.
6. The method according to claim 4 or 5, characterized in that: The graph convolutional neural network includes a two-layer network structure.
7. The method according to claim 1, characterized in that After the alarm data and the alarm handling solution are pushed to the client to which the target object belongs, the method further includes: Obtaining an input optimization plan for the alarm handling plan; Determining a target alarm classification corresponding to the optimization scheme; Based on the alarm data and the target alarm classification, the alarm classification model is optimized.
8. An alarm data processing device, characterized in that: include: A first acquisition unit, used to acquire alarm data generated by the business system; An input unit, used to input the alarm data into an alarm classification model to obtain the alarm classification to which the alarm data belongs; the alarm classification model is pre-established based on a graph convolutional neural network; A second acquisition unit, used to acquire a preset alarm handling solution corresponding to the alarm classification; The push unit is used to push the alarm data and the alarm handling solution to the client to which the R&D personnel belong.
9. A storage medium, characterized in that: The storage medium stores an instruction set, wherein the instruction set, when executed by a processor, implements the alarm data processing method according to any one of claims 1 to 7.
10. An electronic device, characterized in that: include: A memory for storing at least one set of instructions; A processor is used to execute an instruction set stored in the memory, and implement the alarm data processing method according to any one of claims 1 to 7 by executing the instruction set.