Fault warning method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a fault warning method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring alarm data in a target time period and an alarm feature vector corresponding to the alarm data; performing clustering processing on the alarm data based on an area to which the alarm data belongs and the alarm feature vector to obtain at least one cluster; aiming at each clustering cluster, carrying out content aggregation on the alarm data contained in the clustering cluster to obtain an alarm node corresponding to the clustering cluster; and analyzing an association relationship among the alarm nodes through an association analysis strategy, generating a fault directed graph network based on the association relationship among the alarm nodes, and outputting the fault directed graph network. By adopting the method, the fault positioning efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a fault alarm method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] Cloud systems play a key role in modern business. When a cloud system fails, it may cause service interruption, data loss, or users cannot access key functions. Therefore, quickly and accurately locating the root cause of the failure is crucial to ensure business continuity of the cloud system and user experience.

[0003] Alarm data is an important tool for system equipment to record the operating status. In traditional technologies, when the system operates abnormally, operation and maintenance personnel can quickly discover abnormal problems and locate the cause of the fault through the information recorded in the alarm data.

[0004] However, as the number of cloud system devices increases, the network structure becomes more complex, with sites, services, and application components calling and affecting each other. When a node fails, the fault will propagate along the call link, generating a large amount of scattered alarm data, making it impossible for operation and maintenance personnel to determine the root cause of the fault in a short time, and the fault location efficiency is low. Summary of the invention

[0005] Based on this, it is necessary to provide a fault alarm method, device, computer equipment, computer readable storage medium and computer program product that can improve the efficiency of fault location in response to the above technical problems.

[0006] In a first aspect, the present application provides a fault alarm method, the method comprising:

[0007] Acquire alarm data within a target period and an alarm feature vector corresponding to the alarm data;

[0008] Based on the region to which the alarm data belongs and the alarm feature vector, clustering the alarm data to obtain at least one cluster;

[0009] For each cluster, performing content aggregation on the alarm data contained in the cluster to obtain an alarm node corresponding to the cluster;

[0010] By using the association analysis strategy, the association relationship between the alarm nodes is analyzed, a fault directed graph network is generated based on the association relationship between the alarm nodes, and the fault directed graph network is output.

[0011] In one embodiment, the obtaining of alarm data within a target period and an alarm feature vector corresponding to the alarm data includes:

[0012] Obtain the original alarm data within the target period;

[0013] Based on a preset word segmentation algorithm, each of the original alarm data is segmented to obtain multiple content entities, and a text weight corresponding to each of the content entities is determined;

[0014] Based on the text weight, target content entities that meet preset weight conditions are selected from the content entities, and alarm data is constructed based on the target content entities and field information included in each of the original alarm data;

[0015] The warning data is input into a text encoding model to obtain a warning feature vector corresponding to the warning data.

[0016] In one of the embodiments, clustering the alarm data based on the region to which the alarm data belongs and the alarm feature vector to obtain at least one cluster includes:

[0017] Determining text similarity between each of the warning data, and determining feature similarity between warning feature vectors corresponding to each of the warning data;

[0018] Determining the comprehensive distance between each of the warning data based on the text similarity between each of the warning data and the feature similarity between the warning feature vectors corresponding to each of the warning data;

[0019] Based on the area to which the alarm data belongs, dividing the alarm data into a plurality of data groups;

[0020] For each data group, clustering is performed on the alarm data contained in the data group based on the comprehensive distance of the alarm data contained in the data group to obtain at least one cluster.

[0021] In one embodiment, the determining the text similarity between the warning data includes:

[0022] For any two alarm data, determine a first set corresponding to the first alarm data in the any two alarm data, and a second set corresponding to the second alarm data in the any two alarm data; wherein the first set includes the content entity of the first alarm data, and the second set includes the content entity of the second alarm data;

[0023] taking a difference between the first set and the second set as a first difference set, and taking a difference between the second set and the first set as a second difference set;

[0024] Determine the similarity between each content entity in the first difference set and each content entity in the second difference set to obtain a similarity set, and determine a target similarity that satisfies a preset similarity condition in the similarity set;

[0025] The text similarity between the first warning data and the second warning data is calculated based on the target similarity, the number of content entities commonly included in the first set and the second set, and the number of content entities included in the union of the first set and the second set.

[0026] In one embodiment, the alarm node includes at least one alarm data; the alarm data includes at least one content entity, and the content aggregation of the alarm data included in the cluster to obtain the alarm node corresponding to the cluster includes:

[0027] In the cluster, determining the alarm data corresponding to the cluster center as basic node data;

[0028] Based on a preset frequent item mining algorithm, determining key content entities in each of the alarm data included in the cluster;

[0029] The key content entity is added to the basic node data to obtain an alarm node.

[0030] In one embodiment, the content entity includes a network address; and the analyzing the association relationship between the alarm nodes through the association analysis strategy includes:

[0031] Based on the network address included in each of the alarm nodes, determining whether an address association condition is satisfied between each two alarm nodes, and if the address association condition is satisfied, determining that there is an association relationship between the two alarm nodes; and / or,

[0032] Based on the alarm content contained in each of the alarm nodes, content entity pairs satisfying content association conditions are determined between every two alarm nodes. If the number of content entity pairs satisfying the content association conditions is greater than a preset threshold, it is determined that the two alarm nodes are associated.

[0033] In a second aspect, the present application provides a fault alarm device, the device comprising:

[0034] An acquisition module, used to acquire alarm data within a target period and an alarm feature vector corresponding to the alarm data;

[0035] A processing module, configured to perform clustering processing on the alarm data based on the region to which the alarm data belongs and the alarm feature vector, to obtain at least one cluster;

[0036] An aggregation module, for performing content aggregation on the alarm data contained in each cluster to obtain an alarm node corresponding to the cluster;

[0037] The output module is used to analyze the association relationship between the alarm nodes through an association analysis strategy, generate a fault directed graph network based on the association relationship between the alarm nodes, and output the fault directed graph network.

[0038] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0040] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0041] The above-mentioned fault alarm method, device, computer equipment, computer-readable storage medium and computer program product can obtain the alarm data within the target period and the alarm feature vector corresponding to the alarm data, cluster the alarm data based on the area to which the alarm data belongs and the alarm feature vector, obtain at least one cluster cluster, and for each cluster cluster, perform content aggregation on the alarm data contained in the cluster cluster to obtain the alarm node corresponding to the cluster cluster, and then analyze the association relationship between the alarm nodes through the association analysis strategy, generate a fault directed graph network based on the association relationship between the alarm nodes, and output the fault directed graph network. In this scheme, by analyzing and aggregating the alarm data, important alarm information can be effectively extracted and the amount of alarm information can be reduced. At the same time, by analyzing the association relationship between the alarm nodes, generating a fault directed graph network based on the association relationship between the alarm nodes, and outputting the fault directed graph network, the connection between the alarms can be clearly and accurately displayed, which helps the operation and maintenance personnel to quickly sort out the alarm context, locate the root cause of the problem, and improve the efficiency of fault location. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A schematic diagram of a flow chart of a fault alarm method in an embodiment;

[0044] Figure 2 A schematic diagram of a flow chart of an example of a fault alarm method in an embodiment;

[0045] Figure 3 is a schematic diagram of a fault directed graph network in one embodiment;

[0046] Figure 4 A flowchart of an example of a fault alarm method in another embodiment;

[0047] Figure 5 is a structural block diagram of a fault alarm device in an embodiment;

[0048] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] The embodiment of the present application provides a fault alarm method. The present embodiment uses the method applied to a terminal as an example. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. It is understandable that the method can be applied to any terminal with a data processing function, and the embodiment of the present application does not limit it.

[0051] Cloud systems play a key role in modern business. When a cloud system fails, it may cause service interruption, data loss, or users cannot access key functions. Therefore, quickly and accurately locating the root cause of the failure is crucial for cloud system business continuity and user experience. Alarm data is an important tool for system equipment to record the operating status. When the system runs abnormally, operation and maintenance personnel can quickly discover abnormal problems and locate the cause of the failure through the information recorded in the alarm data. However, as the number of cloud system devices increases, the network structure becomes more complex, and sites, services, and application components call and affect each other. When a node fails, the fault will propagate along the call link and generate a large amount of alarm data. Root cause alarms are easily submerged in the massive alarm data, making it difficult for operation and maintenance personnel to determine the root cause of the failure in a short time, and unable to establish connections between alarms, resulting in difficulty and time-consuming to determine the root cause of the failure, and low efficiency in fault location.

[0052] The fault alarm method provided in the embodiment of the present application effectively summarizes the alarm information and reduces the number of alarms through efficient alarm data aggregation. At the same time, the fault propagation link is generated through correlation analysis between alarms and network pruning, and a fault propagation directed graph network based on alarm data is established. Through network visualization, it helps operation and maintenance personnel to quickly find the source alarm and locate the root cause of the fault. The fault alarm method provided by the present application will be described in detail below in combination with specific implementation methods. Figure 1 As shown, the method comprises the following steps:

[0053] Step 102: Acquire alarm data within a target period and an alarm feature vector corresponding to the alarm data.

[0054] In an embodiment of the present application, the terminal can obtain the alarm data within the target time period and the alarm feature vector corresponding to each alarm data. Specifically, the terminal can obtain the alarm data within the time period before and after the fault occurs. For example, the target time period can be determined with the time point of the fault as the center and the preset time length as the interval, and then the alarm data within the time period can be obtained. The terminal can obtain the original alarm data within the time period. The original alarm data is the alarm data generated by the system equipment. Then, the original alarm data is cleaned and preprocessed, and the important entity content in the original alarm data is extracted, and the alarm data to be used is reorganized, and each alarm data is feature extracted to obtain the alarm feature vector corresponding to each alarm data. Among them, the alarm data is structured data composed of multiple fields, and the content data corresponding to each field can be called a content entity. In an example, the fields contained in the alarm data include at least IP address, MAC address, and resource pool.

[0055] Step 104: cluster the alarm data based on the region to which the alarm data belongs and the alarm feature vector to obtain at least one cluster.

[0056] In the embodiment of the present application, for each alarm data, the terminal can determine the region to which the alarm data belongs according to the resource pool contained in the alarm data. Then, the terminal can cluster the alarm data based on the region to which the alarm data belongs and the alarm feature vector using a preset clustering algorithm to obtain at least one cluster cluster.

[0057] Step 106: for each cluster, perform content aggregation on the alarm data contained in the cluster to obtain an alarm node corresponding to the cluster.

[0058] In the embodiment of the present application, for each cluster, the terminal can perform content aggregation on the alarm data contained in the cluster to obtain the alarm node corresponding to the cluster. Specifically, the terminal can filter out important content entities from the alarm data contained in the cluster based on the content screening strategy, and the important content entities constitute the alarm node.

[0059] Step 108: Analyze the association relationship between the alarm nodes through the association analysis strategy, generate a fault directed graph network based on the association relationship between the alarm nodes, and output the fault directed graph network.

[0060] In an embodiment of the present application, an association analysis strategy may be stored in the terminal, and the association analysis strategy may analyze whether there is an association relationship between the alarm nodes based on the data content contained in the alarm nodes. If the terminal determines through the association analysis strategy that there is an association relationship between the two alarm nodes, an association edge between the two nodes is established. If the terminal determines through the association analysis strategy that there is no association relationship between the two alarm nodes, no processing is performed. In this way, the terminal can connect the associated alarm nodes to obtain a fault directed graph network. Then, the terminal can visualize the fault directed graph network through a dynamic visualization tool. Among them, the fault directed graph network may at least include alarm nodes and connecting lines between alarm nodes. In addition, the terminal can also display the data content contained in the alarm node in response to a viewing operation on the alarm node.

[0061] In this solution, by analyzing and aggregating alarm data, important alarm information can be effectively extracted and the amount of alarm information can be reduced. At the same time, by analyzing the correlation between alarm nodes, a fault directed graph network is generated based on the correlation between alarm nodes, and the fault directed graph network is output, which can clearly and accurately display the relationship between alarms, help operation and maintenance personnel quickly sort out the alarm context, locate the root cause of the problem, and improve the efficiency of fault location.

[0062] Optional, such as Figure 2 As shown, the obtaining of the alarm data within the target time period and the alarm feature vector corresponding to the alarm data includes:

[0063] Step 202: Acquire original alarm data within a target period.

[0064] In the embodiment of the present application, the terminal can obtain original alarm data within the target period, wherein the original alarm data is alarm data generated by the system device and received by the terminal.

[0065] Step 204: Based on a preset word segmentation algorithm, each of the original alarm data is segmented to obtain a plurality of content entities, and a text weight corresponding to each of the content entities is determined.

[0066] In the embodiment of the present application, the terminal can perform preprocessing such as data cleaning, field screening, abnormal information filtering, missing value filling, data type conversion (such as date format standardization) on the original alarm data to obtain the preprocessed original alarm data. For example, the content of the preset field can be extracted from the original alarm data for retention, and the information of other fields can be removed to reduce the amount of data processing; or, based on the preset filling strategy, the missing values ​​in the original alarm data can be filled, etc. The specific preprocessing strategy can be configured by the technician according to actual needs, and the embodiment of the present application does not limit it.

[0067] The terminal can extract the target content from the pre-processed raw alarm data through a pre-defined regular template. For example, it can extract important location information such as IP address, MAC address and resource pool. Then, it can accurately segment the extracted target content through a pre-established industry dictionary library, and identify whether the segmentation results contain preset segmentations that need to be filtered out, such as stop words, and finally obtain multiple content entities. The terminal can also calculate the text weight corresponding to each content entity based on a preset weight algorithm.

[0068] Optionally, the terminal can input the content entity into a pre-trained text weight prediction model to obtain the text weight corresponding to the content entity. Alternatively, the TF-IDF (term frequency-inverse document frequency) of the content entity can be calculated as the text weight corresponding to the content entity. The specific calculation process is as follows:

[0069] TF-IDF is divided into TF (term frequency, indicating the frequency of occurrence of the content entity in the original alarm data) and IDF (inverse document frequency, indicating the prevalence of the content entity in all original alarm data).

[0070]

[0071] Among them, n i,j Represents content entity e i In the original alarm data d j The number of occurrences in TF i,j Represents entity e i In the alarm data j The frequency of occurrence in .

[0072]

[0073] Where, |D| represents the number of all alarm data, |j: e i ∈d j | indicates that the entity e is included i The number of raw alarm data.

[0074]

[0075] Step 206: based on the text weight, target content entities satisfying preset weight conditions are screened from the content entities, and alarm data are constructed based on the target content entities and field information included in the original alarm data.

[0076] In an embodiment of the present application, the terminal can determine whether the text weight of each content entity is greater than a preset weight threshold. If it is greater than or equal to the preset weight threshold, the content entity is the target content entity; if it is less than the preset weight threshold, the content entity is not the target content entity. For each original alarm data after preprocessing, the terminal can determine the target content entity it contains, and then construct the alarm data based on the target content entity contained in the original alarm data and the field information (such as field structure) corresponding to the original alarm data.

[0077] Step 208: input the warning data into a text encoding model to obtain a warning feature vector corresponding to the warning data.

[0078] In the embodiment of the present application, after the alarm data is determined, the alarm data can be input into a text encoding model to obtain an alarm feature vector corresponding to the alarm data.

[0079] In this solution, the original alarm data can be preprocessed and information refined to obtain the content in the original alarm data and perform feature extraction, so that the information content of the alarm data and the alarm feature vector is effectively improved and the data processing amount is reduced.

[0080] Optionally, the alarm data is clustered based on the region to which the alarm data belongs and the alarm feature vector to obtain at least one cluster, including: determining the text similarity between each of the alarm data, and determining the feature similarity between the alarm feature vectors corresponding to each of the alarm data; determining the comprehensive distance between each of the alarm data based on the text similarity between each of the alarm data and the feature similarity between the alarm feature vectors corresponding to each of the alarm data; dividing the alarm data into multiple data groups based on the region to which the alarm data belongs; for each data group, clustering the alarm data contained in the data group based on the comprehensive distance of the alarm data contained in the data group to obtain at least one cluster.

[0081] In the embodiment of the present application, for any two alarm data, the terminal can calculate the similarity (i.e., comprehensive distance) between the two alarm data. Specifically, the terminal can calculate the text similarity between the two alarm data and the feature similarity between the alarm feature vectors corresponding to the two alarm data. aThe alarm feature vector vec of the alarm data b b The feature similarity DIST vec The calculation formula is as follows:

[0082]

[0083] The text similarity can be obtained through a pre-trained prediction model or calculated through other text similarity algorithms, which will be described in detail later. The terminal can calculate the comprehensive distance DIST between the two alarm data based on the text similarity between the two alarm data and the feature similarity between the feature vectors of each alarm. The calculation formula is as follows:

[0084]

[0085] Among them, α and β are pre-configured weights, DIST jacard-optim is the text similarity.

[0086] The terminal can divide the alarm data of the same area into the same data group to obtain the data group corresponding to each area. Then, for each data group, based on the comprehensive distance of the alarm data contained in the data group, the alarm data contained in the data group is clustered to obtain at least one cluster cluster. The clustering algorithm can adopt the DBSCAN density clustering algorithm, which is suitable for scenarios where the difference between alarm data classes is large and the number of clusters is unclear.

[0087] In this solution, the original alarm data can be efficiently aggregated, and the important information in the alarm data can be effectively summarized and refined to reduce the number of alarms.

[0088] Optionally, determining the text similarity between each of the alarm data includes: for any two alarm data, determining a first set corresponding to the first alarm data in the any two alarm data, and a second set corresponding to the second alarm data in the any two alarm data; wherein the first set contains content entities of the first alarm data, and the second set contains content entities of the second alarm data; taking the difference between the first set and the second set as the first difference set, and taking the difference between the second set and the first set as the second difference set; determining the similarity between each content entity in the first difference set and each content entity in the second difference set to obtain a similarity set, and determining a target similarity in the similarity set that meets a preset similarity condition; calculating the text similarity between the first alarm data and the second alarm data based on the target similarity, the number of content entities commonly included in the first set and the second set, and the number of content entities included in the union of the first set and the second set.

[0089] In an embodiment of the present application, in each alarm data, the terminal can calculate the text similarity between any two alarm data. For ease of description, the two alarm data can be referred to as the first alarm data and the second alarm data, respectively. Since the alarm data is structured data and consists of multiple content entities, the content entities contained in the first alarm data can be taken as the first set, denoted as A, and the content entities contained in the second alarm data can be taken as the second set, denoted as B. Among them, the elements in set A are denoted as ai, and the elements in set B are denoted as bi.

[0090] The terminal can calculate the intersection (A∩B) and the union (A∪B) of set A and set B, and can determine the difference set A1 between A and B, and the difference set B1 between B and A. Then, the terminal calculates the similarity between all elements in A1 and all elements in B1, and constructs a similarity set S based on the calculated similarity.

[0091] The terminal sorts the set S from high to low to obtain a sequence of similarities, and then determines the highest similarity in the sequence, and the element corresponding to the highest similarity, assuming it is ai and bj. The terminal can cache the highest similarity and delete all similarities related to ai and bj in the sequence (including the highest similarity) to obtain an updated sequence. Then, based on the updated sequence, return to the execution step to determine the highest similarity in the sequence. And so on, until the sequence is empty. The terminal can sum the cached similarities, and the sum can be recorded as CNT. Then, the text similarity is calculated by the following formula:

[0092]

[0093] Optionally, the alarm node contains at least one alarm data; the alarm data contains at least one content entity, and content aggregation is performed on the alarm data contained in the cluster cluster to obtain the alarm node corresponding to the cluster cluster, including: in the cluster cluster, determining the alarm data corresponding to the cluster center as basic node data; based on a preset frequent item mining algorithm, determining key content entities in each of the alarm data contained in the cluster cluster; and adding the key content entity to the basic node data to obtain an alarm node.

[0094] In an embodiment of the present application, for each cluster, the terminal can determine the alarm data corresponding to the cluster center in the cluster as the basic node data. Then, the terminal can determine the key content entity in each of the alarm data contained in the cluster based on a preset frequent item mining algorithm, and then, based on the field information (such as field structure) of the alarm data, add the key content entity to the same field of the basic node data. In this way, an alarm node containing multiple key content entities can be obtained, and the intra-class information aggregation extraction of the alarm data can be realized.

[0095] In this solution, the clustered alarm data can be further aggregated and key information extracted, which improves the degree of information aggregation, reduces the amount of invalid information, and thus improves the efficiency of fault location.

[0096] Optionally, the content entity includes a network address; and the analyzing the association relationship between the alarm nodes through the association analysis strategy includes:

[0097] Method 1: Based on the network address included in each of the alarm nodes, determine whether an address association condition is satisfied between every two alarm nodes; if the address association condition is satisfied, determine that there is an association relationship between the two alarm nodes.

[0098] In an embodiment of the present application, for any two alarm nodes, the terminal can determine whether the address association condition is satisfied between the two alarm nodes based on the network addresses contained in the two alarm nodes. If the address association condition is satisfied, it is determined that the two alarm nodes have an association relationship; otherwise, it is determined that the two alarm nodes do not satisfy the association relationship. For example, it can be determined whether the two alarm nodes have the same IP address. If the same IP address exists, the address association condition is satisfied; if not, the address association condition is not satisfied. Alternatively, it can be determined whether the first three segments of the IP addresses of the two alarm nodes are the same. If they are the same, the address association condition is satisfied; if they are not the same, the address association condition is not satisfied.

[0099] Method 2: Based on the alarm content contained in each alarm node, determine the content entity pairs that meet the content association condition between every two alarm nodes. If the number of content entity pairs that meet the content association condition is greater than a preset threshold, it is determined that the two alarm nodes have an association relationship.

[0100] In an embodiment of the present application, for any two alarm nodes, the terminal can extract the content entities (i.e., alarm contents) contained in the two alarm nodes from the two alarm nodes, respectively, thereby obtaining the first content set and the second content set corresponding to the two alarm nodes. Then, the terminal calculates the similarity between each content entity in the first content set and each content entity in the second content set, and takes the two content entities whose similarity is greater than a preset threshold as similar entity pairs (i.e., content entity pairs). The terminal can count the number of similar entity pairs. If the number is greater than or equal to the preset threshold, it is determined that the two alarm nodes have an associated relationship. Otherwise, it is determined that the two alarm nodes do not have an associated relationship.

[0101] Optionally, for two alarm nodes that have an associated relationship, the terminal establishes an associated edge between the two alarm nodes, thereby connecting the alarm nodes that have an associated relationship together and generating an initial fault propagation directed graph network. The associated edge has a direction, and the direction can be determined based on the time sequence of the alarm time, or it can also be determined based on the area of ​​the alarm, which can be determined specifically according to actual business needs. The terminal can also prune the initial fault propagation directed graph network to obtain a final fault directed graph network. In an example, all alarm nodes can be sorted in order from near to far in alarm time, and then the terminal can traverse the parent node A of each alarm node and trace back its ancestor nodes. If there is a parent node Fa that is the ancestor node of other parent nodes Fb, the directed edge between node A and the parent node Fa is pruned. The final generated fault directed graph network is as follows. Figure 3 shown.

[0102] like Figure 4 As shown, the embodiment of the present application provides an example of a fault alarm method, comprising the following steps:

[0103] Step 401, obtaining original alarm data within a target period.

[0104] Step 402, pre-processing the original alarm data, identifying important target content entities, constructing alarm data and generating an alarm feature vector.

[0105] Step 403: determine the text similarity between each warning data, and determine the feature similarity between the warning feature vectors corresponding to each warning data.

[0106] Step 404 : determining the comprehensive distance between each warning data based on the text similarity between each warning data and the feature similarity between the warning feature vectors corresponding to each warning data.

[0107] Step 405: divide the alarm data into a plurality of data groups based on the area to which the alarm data belongs.

[0108] Step 406 : for each data group, based on the comprehensive distance of the alarm data contained in the data group, cluster the alarm data contained in the data group to obtain at least one cluster.

[0109] Step 407: for each cluster, perform content aggregation on the alarm data contained in the cluster to obtain the alarm node corresponding to the cluster.

[0110] Step 408 , analyzing the association relationship between the alarm nodes, generating a fault directed graph network based on the association relationship between the alarm nodes, and performing network edge pruning on the fault directed graph network to obtain a target fault directed graph network.

[0111] Step 409: Visually display the target fault directed graph network.

[0112] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0113] Based on the same inventive concept, the embodiment of the present application also provides a fault alarm device for implementing the fault alarm method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more fault alarm device embodiments provided below can refer to the limitations of the fault alarm method above, and will not be repeated here.

[0114] In an exemplary embodiment, Figure 5 As shown, a fault alarm device is provided, which includes: an acquisition module 510, a processing module 520, an aggregation module 530 and an output module 540; wherein,

[0115] An acquisition module 510 is used to acquire alarm data within a target period and an alarm feature vector corresponding to the alarm data;

[0116] The processing module 520 is used to perform clustering processing on the alarm data based on the region to which the alarm data belongs and the alarm feature vector to obtain at least one cluster;

[0117] Aggregation module 530, for each cluster, performing content aggregation on the alarm data contained in the cluster to obtain an alarm node corresponding to the cluster;

[0118] The output module 540 is used to analyze the association relationship between the alarm nodes through the association analysis strategy, generate a fault directed graph network based on the association relationship between the alarm nodes, and output the fault directed graph network.

[0119] In one embodiment, the acquisition module 510 is specifically configured to:

[0120] Obtain the original alarm data within the target period;

[0121] Based on the preset word segmentation algorithm, each original alarm data is segmented to obtain multiple content entities, and the text weight corresponding to each content entity is determined;

[0122] Based on the text weight, target content entities that meet the preset weight conditions are selected from various content entities, and alarm data is constructed based on the target content entities and field information contained in each original alarm data;

[0123] The alarm data is input into the text encoding model to obtain the alarm feature vector corresponding to the alarm data.

[0124] In one embodiment, the processing module 520 is specifically configured to:

[0125] Determine the text similarity between each warning data, and determine the feature similarity between the warning feature vectors corresponding to each warning data;

[0126] Determine the comprehensive distance between each warning data based on the text similarity between each warning data and the feature similarity between the warning feature vectors corresponding to each warning data;

[0127] Based on the area to which the alarm data belongs, the alarm data is divided into a plurality of data groups;

[0128] For each data group, clustering is performed on the alarm data contained in the data group based on the comprehensive distance of the alarm data contained in the data group to obtain at least one cluster.

[0129] In one embodiment, the processing module 520 is specifically configured to:

[0130] For any two alarm data, determine a first set corresponding to the first alarm data in the any two alarm data, and a second set corresponding to the second alarm data in the any two alarm data; wherein the first set includes the content entity of the first alarm data, and the second set includes the content entity of the second alarm data;

[0131] The difference between the first set and the second set is taken as the first difference set, and the difference between the second set and the first set is taken as the second difference set;

[0132] Determine the similarity between each content entity in the first difference set and each content entity in the second difference set to obtain a similarity set, and determine a target similarity that satisfies a preset similarity condition in the similarity set;

[0133] The text similarity between the first warning data and the second warning data is calculated based on the target similarity, the number of content entities commonly included in the first set and the second set, and the number of content entities included in the union of the first set and the second set.

[0134] In one embodiment, the alarm node includes at least one alarm data; the alarm data includes at least one content entity, and the aggregation module 530 is specifically used to:

[0135] In the cluster, the alarm data corresponding to the cluster center is determined as the basic node data;

[0136] Based on a preset frequent item mining algorithm, key content entities are determined in each alarm data contained in the cluster;

[0137] Add the key content entity to the basic node data to obtain the alarm node.

[0138] In one embodiment, the content entity includes a network address; the output module 540 is specifically configured to:

[0139] Based on the network addresses included in each alarm node, determining whether an address association condition is satisfied between each two alarm nodes, and if the address association condition is satisfied, determining that there is an association relationship between the two alarm nodes; and / or,

[0140] Based on the alarm content contained in each of the alarm nodes, content entity pairs satisfying content association conditions are determined between every two alarm nodes. If the number of content entity pairs satisfying the content association conditions is greater than a preset threshold, it is determined that the two alarm nodes are associated.

[0141] Each module in the above fault alarm device can be implemented in whole or in part by software, hardware and a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0142] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a fault alarm method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0143] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0144] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned fault alarm method are implemented.

[0145] In one embodiment, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the steps of the above-mentioned fault alarm method are implemented.

[0146] It should be noted that the user information (including but not limited to user device identification, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0147] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0148] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0149] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A fault alarm method, characterized in that: The method comprises: Acquire alarm data within a target period and an alarm feature vector corresponding to the alarm data; Based on the region to which the alarm data belongs and the alarm feature vector, clustering the alarm data to obtain at least one cluster; For each cluster, performing content aggregation on the alarm data contained in the cluster to obtain an alarm node corresponding to the cluster; By using the association analysis strategy, the association relationship between the alarm nodes is analyzed, a fault directed graph network is generated based on the association relationship between the alarm nodes, and the fault directed graph network is output.

2. The method according to claim 1, characterized in that The obtaining of the alarm data within the target time period and the alarm feature vector corresponding to the alarm data includes: Obtain the original alarm data within the target period; Based on a preset word segmentation algorithm, each of the original alarm data is segmented to obtain multiple content entities, and a text weight corresponding to each of the content entities is determined; Based on the text weight, target content entities that meet preset weight conditions are screened from the content entities, and alarm data is constructed based on the target content entities and field information included in the original alarm data; The warning data is input into a text encoding model to obtain a warning feature vector corresponding to the warning data.

3. The method according to claim 1, characterized in that The clustering of the alarm data based on the region to which the alarm data belongs and the alarm feature vector to obtain at least one clustering cluster includes: Determining text similarity between each of the warning data, and determining feature similarity between warning feature vectors corresponding to each of the warning data; Determining the comprehensive distance between each of the warning data based on the text similarity between each of the warning data and the feature similarity between the warning feature vectors corresponding to each of the warning data; Based on the area to which the alarm data belongs, dividing the alarm data into a plurality of data groups; For each data group, clustering is performed on the alarm data contained in the data group based on the comprehensive distance of the alarm data contained in the data group to obtain at least one cluster.

4. The method according to claim 3, characterized in that The determining of the text similarity between the warning data includes: For any two alarm data, determine a first set corresponding to the first alarm data in the any two alarm data, and a second set corresponding to the second alarm data in the any two alarm data; wherein the first set includes the content entity of the first alarm data, and the second set includes the content entity of the second alarm data; taking a difference between the first set and the second set as a first difference set, and taking a difference between the second set and the first set as a second difference set; Determine the similarity between each content entity in the first difference set and each content entity in the second difference set to obtain a similarity set, and determine a target similarity that satisfies a preset similarity condition in the similarity set; The text similarity between the first warning data and the second warning data is calculated based on the target similarity, the number of content entities commonly included in the first set and the second set, and the number of content entities included in the union of the first set and the second set.

5. The method according to claim 1, characterized in that The alarm node includes at least one alarm data; the alarm data includes at least one content entity, and the alarm data included in the cluster is subjected to content aggregation to obtain the alarm node corresponding to the cluster, including: In the cluster, the alarm data corresponding to the cluster center is determined as the basic node data; Based on a preset frequent item mining algorithm, determining key content entities in each of the alarm data included in the cluster; The key content entity is added to the basic node data to obtain an alarm node.

6. The method according to claim 5, characterized in that The content entity includes a network address; and the correlation analysis strategy is used to analyze the correlation relationship between the alarm nodes, including: Based on the network address included in each of the alarm nodes, determining whether an address association condition is satisfied between each two alarm nodes, and if the address association condition is satisfied, determining that there is an association relationship between the two alarm nodes; and / or, Based on the alarm content contained in each of the alarm nodes, content entity pairs satisfying content association conditions are determined between every two alarm nodes. If the number of content entity pairs satisfying the content association conditions is greater than a preset threshold, it is determined that there is an association relationship between the two alarm nodes.

7. A fault alarm device, characterized in that: The device comprises: An acquisition module, used to acquire alarm data within a target period and an alarm feature vector corresponding to the alarm data; A processing module, configured to perform clustering processing on the alarm data based on the region to which the alarm data belongs and the alarm feature vector, to obtain at least one cluster; An aggregation module, for performing content aggregation on the alarm data contained in each cluster to obtain an alarm node corresponding to the cluster; The output module is used to analyze the association relationship between the alarm nodes through an association analysis strategy, generate a fault directed graph network based on the association relationship between the alarm nodes, and output the fault directed graph network.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images