Alarm classification and grading method and device based on improved decision tree algorithm

Abstract

The invention provides an alarm classification and grading method and device based on an improved decision tree algorithm, and relates to the technical field of data processing. Collected historical alarm data is labeled according to a preset classification type and grading level, a label data set is generated, and preprocessing is carried out; selecting an optimal feature through an information gain standard to construct a decision tree node, constructing an alarm classification decision tree based on the selected feature through a recursive splitting mode, and constructing an alarm grading decision tree based on the alarm classification decision tree; training the improved alarm classification decision-making tree and the alarm grading decision-making tree by using a label data set; and inputting the generated new alarm data into the trained alarm classification decision tree and alarm classification decision tree to obtain a classification and classification result. Therefore, by introducing the improved decision tree algorithm, the alarm data can be effectively classified and graded, so that the intelligent level and the response speed of alarm processing of the data center are improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an alarm classification and grading method and device based on an improved decision tree algorithm. Background Art

[0002] With the accelerated advancement of the financial industry's information transformation, it is increasingly dependent on data center infrastructure to support its business operations and data processing needs. As the scale of corporate business continues to expand during the transformation process, the complexity of the system has increased significantly, resulting in a significant increase in the frequency and number of alarm events, which has brought huge management pressure to data center operation and maintenance personnel.

[0003] At present, data centers usually use traditional rule engines to classify alarms, that is, to set alarms through predefined threshold rules or event rules and trigger corresponding response measures. However, as the complexity of rules increases and the amount of data increases, this approach may face performance bottlenecks, and the static characteristics of rule engines cannot effectively adapt to the ever-changing environment and complex alarm patterns. Summary of the invention

[0004] In view of this, the purpose of this application is to provide an alarm classification and grading method and device based on an improved decision tree algorithm. By introducing the improved decision tree algorithm, the alarm data can be effectively classified and graded to improve the intelligence level and response speed of data center alarm processing.

[0005] In a first aspect, an embodiment of the present application provides a method for classifying and grading alarms based on an improved decision tree algorithm, the method comprising the following steps:

[0006] Labeling the collected historical alarm data according to pre-defined classification types and classification levels to generate a label data set for decision tree model training, and preprocessing the label data set;

[0007] Selecting the best features to construct decision tree nodes by information gain criteria, constructing an alarm classification decision tree based on the selected features by recursive splitting, and constructing an alarm grading decision tree based on the alarm classification decision tree;

[0008] The improved alarm classification decision tree and the alarm grading decision tree are trained using the preprocessed label data set; and the generated new alarm data is input into the trained alarm classification decision tree and the alarm grading decision tree to obtain the classification and grading results of the new alarm data.

[0009] In some embodiments, according to the nature of the alarm data, it is divided into four types: hardware alarm, performance alarm, security alarm, and application layer alarm; and for each alarm type, it is divided into multiple levels according to the severity caused, where the higher the severity, the higher the level.

[0010] In some embodiments, the preprocessing of the historical alarm data marked in the label data set includes one or more of data cleaning, data normalization, data conversion, and feature extraction; wherein the extracted features include one or more of alarm time, alarm area, and fault information.

[0011] In some embodiments, the process of selecting the optimal features to construct a decision tree node by an information gain criterion, and constructing an alarm classification decision tree based on the selected features by recursive splitting, comprises the following steps:

[0012] Calculate the information entropy of the label data set, the formula is as follows:

[0013]

[0014] Among them, p i is the probability of the i-th category alarm in the labeled dataset, and k is the total number of categories;

[0015] Calculate the conditional entropy of the feature; for each value aj of feature A, calculate the data subset The formula for conditional entropy is as follows:

[0016]

[0017] Among them, j is the total number of categories of feature A, The characteristic value is a j A subset of the data, Is a subset of data The number of samples, |D| is the number of samples in the original data set;

[0018] Calculate the information gain using the following formula:

[0019] Information Gain(D,A)=Entropy(D)-Entropy(D∣A)

[0020] The feature with the largest information gain is selected as the split feature of the root node. Starting from the root node, a recursive splitting method is used to build an alarm classification decision tree based on the selected features to split the label data set according to the selected features until the number of node samples is lower than the set threshold.

[0021] In some embodiments, the method for constructing the alarm classification decision tree is used to construct an alarm grading decision tree.

[0022] In some embodiments, the constructed alarm classification decision tree and the alarm grading decision tree are improved in the following manner:

[0023] Pruning the constructed alarm classification decision tree and the alarm grading decision tree through pre-pruning and post-pruning;

[0024] Monitor at least one performance indicator of the alarm classification decision tree and the alarm grading decision tree, and adjust the model parameters of the alarm classification decision tree and the alarm grading decision tree according to the monitored performance indicator; wherein the performance indicator includes one or more of accuracy, recall rate, and F1 score.

[0025] In some embodiments, the SQL optimization model adopts a Transformer architecture, and the output optimization suggestions for the SQL to be optimized include one or more of text rewriting, index adjustment, and data query logic re-planning.

[0026] In a second aspect, an embodiment of the present application provides an alarm classification and grading device based on an improved decision tree algorithm, the device comprising:

[0027] A labeling module is used to label the collected historical alarm data according to the pre-defined classification type and classification level, generate a label data set for decision tree model training, and pre-process the label data set;

[0028] A construction module, used to select the optimal features to construct decision tree nodes through the information gain criterion, and to construct an alarm classification decision tree based on the selected features through recursive splitting, and to construct an alarm grading decision tree based on the alarm classification decision tree;

[0029] The output module is used to train the improved alarm classification decision tree and the alarm grading decision tree using the preprocessed label data set; and input the generated new alarm data into the trained alarm classification decision tree and the alarm grading decision tree to obtain the classification and grading results of the new alarm data.

[0030] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the alarm classification and grading method based on the improved decision tree algorithm as described in any one of the first aspects are performed.

[0031] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the alarm classification and grading method based on the improved decision tree algorithm described in any one of the first aspects above are executed.

[0032] The present application discloses an alarm classification and grading method and device based on an improved decision tree algorithm, which labels the collected historical alarm data according to the pre-established classification type and grading level, generates a label data set for training the decision tree model, and pre-processes the label data set; selects the optimal feature to construct the decision tree node by the information gain standard, and constructs an alarm classification decision tree based on the selected feature by recursive splitting, and constructs an alarm grading decision tree based on the alarm classification decision tree; uses the pre-processed label data set to train the improved alarm classification decision tree and the alarm grading decision tree; and inputs the generated new alarm data into the trained alarm classification decision tree and the alarm grading decision tree to obtain the classification and grading results of the new alarm data. Thus, by introducing the improved decision tree algorithm, the alarm data can be effectively classified and graded to improve the intelligence level and response speed of the alarm processing in the data center. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 A flowchart of the alarm classification and grading method based on the improved decision tree algorithm described in an embodiment of the present application is shown;

[0035] Figure 2 A flowchart of selecting optimal features to construct decision tree nodes by information gain criteria and constructing an alarm classification decision tree based on the selected features by recursive splitting is shown in an embodiment of the present application;

[0036] Figure 3 A schematic diagram of the structure of the alarm classification and grading device based on the improved decision tree algorithm described in an embodiment of the present application is shown;

[0037] Figure 4 A structural block diagram of an electronic device described in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0038] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0039] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0040] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0041] In view of the technical problems raised by the background technology, the present application provides an alarm classification and grading method and device based on an improved decision tree algorithm. By introducing the improved decision tree algorithm, the alarm data can be effectively classified and graded to improve the intelligence level and response speed of data center alarm processing.

[0042] See the instruction manual Figure 1 The embodiment of the present application provides an alarm classification and grading method based on an improved decision tree algorithm, comprising the following steps:

[0043] S1. Label the collected historical alarm data according to the pre-defined classification type and classification level, generate a label data set for decision tree model training, and pre-process the label data set;

[0044] S2. Selecting the optimal features to construct decision tree nodes by information gain criteria, constructing an alarm classification decision tree based on the selected features by recursive splitting, and constructing an alarm grading decision tree based on the alarm classification decision tree;

[0045] S3. Use the preprocessed label data set to train the improved alarm classification decision tree and the alarm grading decision tree; and input the generated new alarm data into the trained alarm classification decision tree and the alarm grading decision tree to obtain the classification and grading results of the new alarm data.

[0046] Specifically, in step S1, historical alarm data is collected from the alarm monitoring platform, which is the basic material for subsequent model construction and training. The historical alarm data contains the details of various alarms that occurred during the operation of the system in the past, such as the time when the alarm occurred, the equipment involved, the specific description of the alarm, etc. In this application, when setting the alarm classification type, the first consideration is the nature of the alarm and its possible impact on the business system. In this way, it is divided into four categories: hardware alarm, performance alarm, security alarm, and application layer alarm. This classification method can distinguish alarms of different sources and natures from a macro perspective, which helps operation and maintenance personnel to quickly locate the approximate category to which the alarm belongs. Among them, for hardware alarms, it is subdivided into server alarms, network equipment alarms, storage equipment alarms, etc. according to the specific hardware equipment involved. Such a subdivision enables us to know more accurately which type of hardware equipment has a problem when a hardware-related alarm occurs, so as to carry out investigation and repair work more targetedly; for performance alarms, it is subdivided into CPU usage, memory usage, storage space alarms, etc. according to the key performance indicators of the system. These segmented performance alarms can directly reflect the status of the system in terms of resource utilization. When a performance alarm occurs, you can quickly focus on whether the corresponding system resources have bottlenecks or abnormal conditions. For security alarms, they are segmented into intrusion monitoring alarms, identity authentication alarms, data leakage alarms, etc. according to different security protection levels and threat types. This segmentation helps to clarify the specific source and nature of security threats so that appropriate security protection and response measures can be taken. For application layer alarms, they are segmented into service unavailable alarms, error log alarms, etc. according to the types of problems that may occur during the operation of the application. When such alarms occur, you can quickly determine which function of the application has failed, and then perform targeted debugging and repairs on the application.

[0047] In addition, the present application also sets alarm levels for different types of alarms. In one embodiment, each type of alarm is divided into four levels according to the severity: general, important, severe, and critical. Among them, an alarm of the "critical" level may be a situation involving a complete failure of key equipment and will immediately cause business interruption; an alarm of the "severe" level may be a situation that will not immediately cause business interruption, but will have a greater impact on the important functions of the system; an alarm of the "important" level may be a situation that has a certain impact on some functions of the system, but can be repaired by conventional means within a certain period of time; an alarm of the "general" level may be a situation that has a relatively small impact on the overall operation of the system and can be handled at an appropriate time later.

[0048] The collected historical alarm data is labeled according to the above-mentioned classification types and classification levels, with the purpose of generating a label data set for decision tree model training. In this way, the model can learn the characteristics of alarms of different types and levels during the training process, so that when faced with new alarms in the future, it can make accurate judgments based on these characteristics, accurately classify and grade new alarms, and improve the efficiency and accuracy of alarm processing.

[0049] Furthermore, in this application, the historical alarm data marked in the label data set is also preprocessed, including data cleaning, data normalization, data conversion and feature extraction, so as to ensure the quality and accuracy of the input data, and provide a standardized alarm data content input format for the subsequent decision tree model construction. Among them, the data cleaning stage systematically processes the original sample alarm data to remove redundant, erroneous and inconsistent records. This step includes identifying and correcting missing values ​​in the data, filling missing data by mean filling or interpolation methods, and detecting and excluding outliers to prevent them from having an adverse effect on subsequent analysis; during the data normalization process, all numerical alarm features are standardized to eliminate the influence of dimensional differences between features. The normalization operation ensures that the features are compared and analyzed on the same scale, thereby improving the training effect and stability of the model; data conversion converts the category data into a format that the algorithm can process. Through methods such as unique hot encoding, the category features are converted into binary form to ensure that all alarm features can be correctly understood and processed by the decision tree model; the feature extraction stage extracts key features from the processed data, which include alarm time, alarm area, fault information, etc. By accurately selecting and constructing rich and valuable feature sets, we ensure that the key attributes of the alarm can be fully reflected and provide effective input information for the classification and grading models.

[0050] See the instruction manual Figure 2In step S2, the optimal features are selected by the information gain standard to construct a decision tree node, and an alarm classification decision tree is constructed based on the selected features by recursive splitting, including the following steps:

[0051] S201. Calculate the information entropy of the label data set. The formula is as follows:

[0052]

[0053] Where pi is the probability of the i-th category alarm in the label data set, and k is the total number of categories;

[0054] S202, calculate the conditional entropy of the feature; wherein, for each value aj of feature A, calculate the data subset The formula for conditional entropy is as follows:

[0055]

[0056] Among them, j is the total number of categories of feature A, The characteristic value is a j A subset of the data, Is a subset of data The number of samples, |D| is the number of samples in the original data set;

[0057] S203, calculate information gain, the formula is as follows:

[0058] Information Gain(D,A)=Entropy(D)-Entropy(D∣A)

[0059] S204, selecting the feature with the largest information gain as the split feature of the root node, starting from the root node, using a recursive splitting method to build an alarm classification decision tree based on the selected features, so as to split the label data set according to the selected features until the number of node samples is lower than the set threshold.

[0060] Specifically, in step S201-step S203, information entropy is a measure of the uncertainty of a data set. In a labeled data set, if the probability of occurrence of various types of alarms is relatively uniform, then the information entropy will be relatively high, indicating that it is difficult to accurately determine which category the next alarm will belong to purely from a probability perspective; conversely, if the probability of occurrence of a certain type of alarm is extremely high, the information entropy will be lower, indicating that the uncertainty of the data set is smaller and it is easier to predict the alarm category; by calculating the conditional entropy of the feature, it is possible to understand the change in the uncertainty of the data set when the value of feature A is known; and the information gain is the amount of entropy reduction after the data set is split by feature A.

[0061] In step S204, first, according to the above method for calculating information gain, the feature with the largest information gain is selected as the split feature of the root node; then, the data set is split according to the value range of the feature to obtain several sub-data sets. For each sub-data set, the above process of calculating information gain and selecting split features is repeated, and splitting is performed again, and this process is recursively performed. This process will continue until the number of node samples is lower than the set threshold. When the number of samples in the node is too small, continued splitting may cause overfitting, that is, the decision tree is too complex and fits the training data well, but may not accurately classify new alarm information. Therefore, when this stop condition is reached, the construction of the classification decision tree is completed.

[0062] Each node of the classification decision tree represents a feature, such as alarm time, alarm type, etc.; each branch represents the value range of the feature, and each leaf node represents an alarm category, such as hardware alarm, performance alarm, etc. Based on this decision tree, for new alarm information, we can start from the root node and traverse down along the decision path according to the feature value until we reach the leaf node to determine the final classification result.

[0063] Furthermore, in this application, on the basis of completing the construction of the alarm classification decision tree, we further construct an alarm grading decision tree. Since the alarms have been divided into different categories, such as hardware alarms, performance alarms, etc., through the classification decision tree, the grading decision tree focuses on determining the specific level of each category based on key features such as the severity of the alarm.

[0064] Specifically, the optimal feature is selected for node splitting based on information gain. For each alarm data set in each category, the information gain of different features (such as severity-related features, etc.) is calculated. For example, for the severity feature in the hardware alarm category, its information gain is calculated to evaluate the effectiveness of the feature in dividing alarms of different levels; the feature with the largest information gain is selected as the split feature of the current node, and a hierarchical decision tree is constructed recursively starting from the root node. The alarm data set in each category is split according to the selected features to generate sub-datasets. Then continue to calculate the information gain and select the split features for the sub-datasets, and continue this process until certain stopping conditions are met, such as the number of samples in the node is lower than the set threshold or all alarms can be accurately divided into corresponding levels.

[0065] Furthermore, in the present application, the constructed alarm classification decision tree and the alarm grading decision tree are optimized through pruning technology and dynamic adjustment mechanism.

[0066] Among them, the complexity of the decision tree model is optimized through pruning technology to improve its generalization ability. Pre-pruning limits the growth of the tree by setting parameters such as the maximum depth, the minimum number of sample splits, and the minimum number of sample leaf nodes during the tree construction process, thereby preventing overfitting. After the tree is fully built, post-pruning removes unnecessary branches, simplifies the tree structure, and selects the pruned tree that performs best on the validation set through methods such as cost complexity pruning, minimum error pruning, or cross-validation pruning. The two pruning methods work together to help generate accurate and concise decision tree models, thereby improving the accuracy of alarm classification and grading.

[0067] In order to cope with the ever-changing environment and complex alarm patterns, the decision tree model is improved based on the idea of ​​a dynamic adjustment mechanism. That is, after the model is deployed to the actual application, the key performance indicators of the decision tree model such as accuracy, recall, F1 score, etc. are continuously monitored and the model parameters are automatically adjusted. For example, if the accuracy of the model on new data decreases, the depth of the decision tree is automatically increased or other parameters are adjusted to improve performance. The dynamic adjustment mechanism enables the model to automatically update parameters when new data is received without completely rebuilding the decision tree.

[0068] In step S3, the improved alarm classification decision tree and the alarm grading decision tree are trained using the preprocessed label data set, and the structure and parameters of the decision tree are adjusted according to the training data, so that the model can accurately grade and classify the alarms. The newly generated alarm data is input into the trained decision tree model, starting from the root node, and the corresponding branch is selected according to the characteristic value of the alarm data at each node until the leaf node is reached. The level or category represented by the leaf node is the classification result of the alarm. In this way, the operation and maintenance personnel can process the alarms according to the priority order according to the classification results of the alarms, thereby improving the operation and maintenance efficiency and reliability of the system.

[0069] It can be seen that the alarm classification and grading method based on the improved decision tree algorithm provided by the present application uses the information gain standard to select the optimal features to construct decision tree nodes, and optimizes the complexity of the decision tree model through pruning technology to improve its generalization ability, and further based on the dynamic adjustment mechanism, the model automatically updates the parameters when receiving new data, so that when dealing with dynamic and complex alarm scenarios, it has more automation, adaptability and optimization potential, thereby improving the efficiency and accuracy of alarm classification.

[0070] Based on the same inventive concept, an alarm classification and grading device based on an improved decision tree algorithm is also provided in an embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned alarm classification and grading method based on an improved decision tree algorithm in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0071] As the instruction manual Figure 3 As shown, the present application also provides an alarm classification and grading device based on an improved decision tree algorithm, the device comprising:

[0072] The labeling module 301 is used to label the collected historical alarm data according to the pre-established classification type and classification level, generate a label data set for training the decision tree model, and pre-process the label data set; wherein, according to the nature of the alarm data, it is divided into four types: hardware alarm, performance alarm, security alarm, and application layer alarm; and for each alarm type, it is divided into multiple levels according to the severity caused, wherein the higher the severity, the higher the level; pre-processing the historical alarm data labeled in the label data set includes one or more of data cleaning, data normalization, data conversion, and feature extraction; wherein the extracted features include one or more of alarm time, alarm area, and fault information;

[0073] A construction module 302 is used to select the optimal features to construct decision tree nodes through the information gain standard, and to construct an alarm classification decision tree based on the selected features through recursive splitting, and to construct an alarm grading decision tree based on the alarm classification decision tree;

[0074] The output module 303 is used to train the improved alarm classification decision tree and the alarm grading decision tree using the preprocessed label data set; and input the generated new alarm data into the trained alarm classification decision tree and the alarm grading decision tree to obtain the classification and grading results of the new alarm data.

[0075] In some embodiments, the construction module 302 selects the optimal features to construct decision tree nodes by the information gain criterion, and constructs an alarm classification decision tree based on the selected features by recursive splitting, including: calculating the information entropy of the label data set, the formula is as follows:

[0076]

[0077] Among them, p i is the probability of the i-th category alarm in the labeled dataset, and k is the total number of categories;

[0078] Calculate the conditional entropy of the feature; for each value aj of feature A, calculate the data subset The formula for conditional entropy is as follows:

[0079]

[0080] Among them, j is the total number of categories of feature A, The characteristic value is a j A subset of the data, Is a subset of data The number of samples, |D| is the number of samples in the original data set;

[0081] Calculate the information gain using the following formula:

[0082] Information Gain(D,A)=Entropy(D)-Entropy(D∣A)

[0083] The feature with the largest information gain is selected as the split feature of the root node. Starting from the root node, a recursive splitting method is used to build an alarm classification decision tree based on the selected features to split the label data set according to the selected features until the number of node samples is lower than the set threshold.

[0084] In some embodiments, the construction module 302 constructs an alarm grading decision tree using the method of constructing the alarm classification decision tree, and improves the constructed alarm classification decision tree and the alarm grading decision tree, including pruning the constructed alarm classification decision tree and the alarm grading decision tree through pre-pruning and post-pruning; monitoring at least one performance indicator of the alarm classification decision tree and the alarm grading decision tree, and adjusting the model parameters of the alarm classification decision tree and the alarm grading decision tree according to the monitored performance indicators; wherein the performance indicators include one or more of accuracy, recall rate, and F1 score.

[0085] In some embodiments, the apparatus further comprises:

[0086] The processing module is used to process the new alarm data in order of priority according to the classification and grading results obtained; wherein, the higher the level, the higher the priority.

[0087] The present application provides an alarm classification and grading device based on an improved decision tree algorithm. The collected historical alarm data is labeled according to the pre-established classification type and grading level through a labeling module to generate a label data set for decision tree model training, and the label data set is preprocessed; the construction module selects the optimal feature to construct a decision tree node through the information gain standard, and constructs an alarm classification decision tree based on the selected feature through a recursive splitting method, and constructs an alarm grading decision tree based on the alarm classification decision tree; the output module uses the pre-processed label data set to train the improved alarm classification decision tree and the alarm grading decision tree; and the generated new alarm data is input into the trained alarm classification decision tree and the alarm grading decision tree to obtain the classification and grading results of the new alarm data. Therefore, by introducing the improved decision tree algorithm, the alarm data can be effectively classified and graded to improve the intelligence level and response speed of data center alarm processing.

[0088] Based on the same concept of the present invention, the specification is attached Figure 4 As shown, the structure of an electronic device 400 provided in an embodiment of the present application includes: at least one processor 401, at least one network interface 404 or other user interface 403, a memory 405, and at least one communication bus 402. The communication bus 402 is used to realize the connection and communication between these components. The electronic device 400 optionally includes a user interface 403, including a display (for example, a touch screen, LCD, CRT, holographic imaging (Holographic) or projection (Projector), etc.), a keyboard or a pointing device (for example, a mouse, a trackball (trackball), a touch pad or a touch screen, etc.).

[0089] The memory 405 may include a read-only memory and a random access memory, and provides instructions and data to the processor 401. A portion of the memory 405 may also include a non-volatile random access memory (NVRAM).

[0090] In some implementations, the memory 405 stores the following elements, which may be protection modules or data structures, or subsets thereof, or extended sets thereof:

[0091] Operating system 4051, including various system programs for implementing various basic services and processing hardware-based tasks;

[0092] The application module 4052 includes various application programs, such as a launcher, a media player, a browser, etc., which are used to implement various application services.

[0093] In an embodiment of the present application, by calling the program or instructions stored in the memory 405, the processor 401 is used to execute steps in an alarm classification and grading method based on an improved decision tree algorithm. By introducing the improved decision tree algorithm, the alarm data can be effectively classified and graded to improve the intelligence level and response speed of the data center alarm processing.

[0094] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the alarm classification and grading method based on the improved decision tree algorithm are executed.

[0095] Specifically, the storage medium can be a general storage medium, such as a mobile disk, a hard disk, etc. When the computer program on the storage medium is executed, the above-mentioned alarm classification and grading method based on the improved decision tree algorithm can be executed.

[0096] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0097] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0098] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0099] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0100] Finally, it should be noted that the above embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for classifying and grading alarms based on an improved decision tree algorithm, characterized in that: The method comprises the following steps: Labeling the collected historical alarm data according to pre-defined classification types and classification levels to generate a label data set for decision tree model training, and preprocessing the label data set; Selecting the best features to construct decision tree nodes by information gain criteria, constructing an alarm classification decision tree based on the selected features by recursive splitting, and constructing an alarm grading decision tree based on the alarm classification decision tree; The improved alarm classification decision tree and the alarm grading decision tree are trained using the preprocessed label data set; and the generated new alarm data is input into the trained alarm classification decision tree and the alarm grading decision tree to obtain the classification and grading results of the new alarm data.

2. The method for classifying and grading alarms based on an improved decision tree algorithm according to claim 1, characterized in that: in, According to the nature of the alarm data, it is divided into four types: hardware alarm, performance alarm, security alarm, and application layer alarm; and for each alarm type, it is divided into multiple levels according to the severity caused, among which the higher the severity, the higher the level.

3. The method for classifying and grading alarms based on an improved decision tree algorithm according to claim 2, characterized in that: in, Preprocessing the historical alarm data marked in the label data set includes one or more of data cleaning, data normalization, data conversion, and feature extraction; wherein the extracted features include one or more of alarm time, alarm area, and fault information.

4. The method for classifying and grading alarms based on an improved decision tree algorithm according to claim 3, characterized in that: The method of selecting the optimal feature to construct a decision tree node by the information gain standard, and constructing an alarm classification decision tree based on the selected feature by recursive splitting, comprises the following steps: Calculate the information entropy of the label data set, the formula is as follows: Among them, p i is the probability of the i-th category alarm in the labeled data set, and k is the total number of categories; Calculate the conditional entropy of the feature; for each value aj of feature A, calculate the data subset The formula for conditional entropy is as follows: Among them, j is the total number of categories of feature A, The characteristic value is a j A subset of the data, Is a subset of data The number of samples, |D| is the number of samples in the original data set; Calculate the information gain, the formula is as follows: Information Gain(D,A)=Entropy(D)-Entropy(D∣A) The feature with the largest information gain is selected as the split feature of the root node. Starting from the root node, a recursive splitting method is used to build an alarm classification decision tree based on the selected features to split the label data set according to the selected features until the number of node samples is lower than the set threshold.

5. The method for classifying and grading alarms based on an improved decision tree algorithm according to claim 4, characterized in that: in, The method for constructing the alarm classification decision tree is adopted to construct an alarm grading decision tree.

6. The method for classifying and grading alarms based on an improved decision tree algorithm according to claim 5, characterized in that: The constructed alarm classification decision tree and alarm grading decision tree are improved in the following manner: Pruning the constructed alarm classification decision tree and the alarm grading decision tree through pre-pruning and post-pruning; Monitor at least one performance indicator of the alarm classification decision tree and the alarm grading decision tree, and adjust the model parameters of the alarm classification decision tree and the alarm grading decision tree according to the monitored performance indicator; wherein the performance indicator includes one or more of accuracy, recall rate, and F1 score.

7. The method for classifying and grading alarms based on an improved decision tree algorithm according to claim 6, characterized in that: The method further comprises the following steps: According to the classification and grading results of the new alarm data, the new alarm data is processed in order of priority; wherein, the higher the level, the higher the priority.

8. An alarm classification and grading device based on an improved decision tree algorithm, characterized in that: The device comprises: A labeling module is used to label the collected historical alarm data according to the pre-defined classification type and classification level, generate a label data set for decision tree model training, and pre-process the label data set; A construction module, used to select the optimal features to construct decision tree nodes through the information gain criterion, and to construct an alarm classification decision tree based on the selected features through recursive splitting, and to construct an alarm grading decision tree based on the alarm classification decision tree; The output module is used to train the improved alarm classification decision tree and the alarm grading decision tree using the preprocessed label data set; and input the generated new alarm data into the trained alarm classification decision tree and the alarm grading decision tree to obtain the classification and grading results of the new alarm data.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the alarm classification and grading method based on the improved decision tree algorithm as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the alarm classification and grading method based on the improved decision tree algorithm as claimed in any one of claims 1 to 7 are executed.

Images