Alarm data processing method and device, equipment and storage medium

Abstract

The invention discloses an alarm data processing method and device, equipment and a storage medium, and belongs to the technical field of big data, and the method comprises the steps: determining target alarm data from candidate alarm data in a search data analysis engine according to a data search request; inputting the target alarm data into the waveform conversion model to obtain target waveform data corresponding to the target alarm data; wherein the waveform conversion model is obtained by training a recurrent neural network model; performing waveform detection on the target waveform data to obtain a target abnormal mode corresponding to the target waveform data; and determining a fault type corresponding to the target alarm data according to the target abnormal mode. According to the invention, the system fault positioning efficiency and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to an alarm data processing method, device, equipment and storage medium. Background Art

[0002] In the current digital environment, the monitoring and alarm systems in banks and other financial institutions continuously generate system alarm data, and the influx of a large amount of system alarm data has brought huge challenges to the system operation and maintenance team. These system alarm data are like a treasure trove of information, hiding key information about the system's operating status.

[0003] However, it is particularly important to quickly and accurately locate system failures based on these system alarm data. Summary of the invention

[0004] The present invention provides an alarm data processing method, device, equipment and storage medium to improve the efficiency and accuracy of system fault locating.

[0005] According to one aspect of the present invention, there is provided a method for processing alarm data, the method comprising:

[0006] According to the data search request, determine the target alarm data from the candidate alarm data in the search data analysis engine;

[0007] Input the target alarm data into the waveform conversion model to obtain the target waveform data corresponding to the target alarm data; wherein the waveform conversion model is obtained by training a recurrent neural network model;

[0008] Performing waveform detection on the target waveform data to obtain a target abnormality pattern corresponding to the target waveform data;

[0009] According to the target abnormal mode, determine the fault type corresponding to the target alarm data.

[0010] According to another aspect of the present invention, there is provided an alarm data processing device, the device comprising:

[0011] A target alarm data determination module is used to determine target alarm data from candidate alarm data in the search data analysis engine according to a data search request;

[0012] A target waveform data determination module is used to input the target alarm data into a waveform conversion model to obtain target waveform data corresponding to the target alarm data; wherein the waveform conversion model is obtained by training a recurrent neural network model;

[0013] A target abnormal pattern determination module is used to perform waveform detection on the target waveform data to obtain a target abnormal pattern corresponding to the target waveform data;

[0014] The fault type determination module is used to determine the fault type corresponding to the target alarm data according to the target abnormal mode.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by at least one processor so that the at least one processor can execute the alarm data processing method of any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm data processing method of any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the alarm data processing method of any embodiment of the present invention is implemented.

[0021] The technical solution of the embodiment of the present invention is to determine the target alarm data from the candidate alarm data in the search data analysis engine according to the data search request; input the target alarm data into the waveform conversion model to obtain the target waveform data corresponding to the target alarm data; wherein the waveform conversion model is obtained by training the recurrent neural network model; waveform detection is performed on the target waveform data to obtain the target abnormal mode corresponding to the target waveform data; and the fault type corresponding to the target alarm data is determined according to the target abnormal mode. The above technical solution uses the search data analysis engine to store the system alarm data in financial institutions such as banks, and after receiving the data search request, the search data analysis engine uses the powerful data search and analysis capabilities to directly determine the target alarm data from the candidate alarm data in the search data analysis engine according to the data search request, thereby improving the determination speed and accuracy of the target alarm data and accelerating the determination speed of the fault type corresponding to the subsequent target alarm data; secondly, the target alarm data is converted into the target waveform data by means of the waveform conversion model, which more intuitively displays the target alarm data; furthermore, the target waveform data is detected by waveform detection to obtain the target abnormal mode corresponding to the target waveform data; and the fault type corresponding to the target alarm data is determined according to the target abnormal mode, thereby improving the accuracy of the fault type corresponding to the target alarm data. In summary, the above technical solution improves the efficiency and accuracy of system fault location.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a flowchart of an alarm data processing method provided according to Embodiment 1 of the present invention;

[0025] Figure 2 is a flowchart of an alarm data processing method provided according to Embodiment 2 of the present invention;

[0026] Figure 3 is a structural diagram of an alarm data processing device provided according to Embodiment 3 of the present invention;

[0027] Figure 4 It is a structural schematic diagram of an electronic device for implementing the alarm data processing method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "target" and "candidate" and the like in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or precedence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] In addition, it should be noted that the collection, storage, use, processing, transmission, provision and disclosure of data search requests and fault type libraries involved in the technical solution of the present invention are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0031] Embodiment 1

[0032] Figure 1 This is a flowchart of an alarm data processing method provided in Embodiment 1 of the present invention. This embodiment is applicable to the situation where a system fault is located based on a large amount of system alarm data. The method can be executed by an alarm data processing device, which can be implemented in the form of hardware and / or software and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0033] S101. According to a data search request, target alarm data is determined from candidate alarm data in a search data analysis engine.

[0034] The data search request refers to a request for searching system alarm data; optionally, the data search request can be obtained from a specified input box of the client. The search data analysis engine refers to a platform that provides data search and data analysis functions. For example, the search data analysis engine can be Elasticsearch (ES for short). Elasticsearch is a distributed, highly scalable, and highly real-time search and data analysis engine that can process large amounts of structured and unstructured data, allowing real-time storage, search, and analysis of large amounts of data.

[0035] It should be noted that in the embodiment of the present invention, a search data analysis engine is used as a platform for storing and querying system alarm data in financial institutions such as banks, wherein the system alarm data refers to the alarm data generated by the monitoring alarm system in financial institutions such as banks.

[0036] Among them, candidate alarm data refers to the alarm data stored in the search data analysis engine. Optionally, for each candidate alarm data in the search data analysis engine, the candidate alarm data includes but is not limited to the alarm start time, alarm end time, alarm type, alarm source and alarm application name. Among them, the alarm source refers to the object or event that triggers the alarm mechanism. The alarm application name refers to the name of the application that generates the alarm data. The target alarm data refers to the candidate alarm data in the search data analysis engine that meets the data search request.

[0037] Specifically, based on a full-text search algorithm and taking a data search request as an index, target alarm data satisfying the data search request can be searched from candidate alarm data in a search data analysis engine.

[0038] S102: Input the target alarm data into a waveform conversion model to obtain target waveform data corresponding to the target alarm data.

[0039] The waveform conversion model is obtained by training a recurrent neural network model. Specifically, the waveform conversion model is obtained by training the recurrent neural network model with sample time series data corresponding to a large amount of historical alarm data. The target waveform data refers to the waveform data obtained after the target alarm data is processed by the waveform conversion model.

[0040] Specifically, the target alarm data is input into the waveform conversion model, and after being processed by the waveform conversion model, the target waveform data corresponding to the target alarm data is obtained.

[0041] S103 , performing waveform detection on the target waveform data to obtain a target abnormality pattern corresponding to the target waveform data.

[0042] Among them, the target abnormal mode refers to a mode used to reflect the abnormal state of the target waveform data; optionally, the target abnormal mode can be one of a sudden increase mode, a sudden drop mode, a slow rise mode, a slow drop mode, a sudden increase and then hold mode, a sudden drop and then hold mode, an upward spike mode, a downward spike mode and a jitter mode.

[0043] Specifically, the target waveform data can be subjected to waveform detection by a preset waveform detection algorithm to obtain a target abnormality pattern corresponding to the target waveform data. The preset waveform detection algorithm can be obtained based on a large amount of experimental data and theoretical derivation in the technical field according to actual waveform detection requirements.

[0044] It is understandable that, since the preset waveform detection algorithm can meet the actual waveform detection requirements, waveform detection is performed on the target waveform data through the preset waveform detection algorithm, so that the obtained target abnormal pattern is more accurate, thereby improving the accuracy of waveform detection.

[0045] S104. Determine the fault type corresponding to the target alarm data according to the target abnormal mode.

[0046] Specifically, a fault type library can be established based on the expert experience of technical personnel in this field; wherein the fault type library is used to record the correspondence between system fault types and waveform abnormality patterns; the target abnormality pattern is matched with the existing waveform abnormality patterns in the fault type library, and the system fault type corresponding to the successfully matched waveform abnormality pattern in the fault type library is used as the fault type corresponding to the target alarm data.

[0047] The technical solution of the embodiment of the present invention is to determine the target alarm data from the candidate alarm data in the search data analysis engine according to the data search request; input the target alarm data into the waveform conversion model to obtain the target waveform data corresponding to the target alarm data; wherein the waveform conversion model is obtained by training a recurrent neural network model; perform waveform detection on the target waveform data to obtain the target abnormal pattern corresponding to the target waveform data; and determine the fault type corresponding to the target alarm data according to the target abnormal pattern. The above technical scheme uses a search data analysis engine to store system alarm data in banks and other financial institutions, and after receiving a data search request, directly determines the target alarm data from the candidate alarm data in the search data analysis engine according to the data search request, and uses the powerful data search and analysis capabilities of the search data analysis engine to quickly and accurately determine the target alarm data, thereby improving the determination speed and accuracy of the target alarm data, and accelerating the determination speed of the fault type corresponding to the subsequent target alarm data; then, the target alarm data is converted into target waveform data with the help of a waveform conversion model, which more intuitively displays the target alarm data; then, by performing waveform detection on the target waveform data, the target abnormal pattern corresponding to the target waveform data is obtained; and according to the target abnormal pattern, the fault type corresponding to the target alarm data is determined, thereby improving the accuracy of the fault type corresponding to the target alarm data, thereby improving the efficiency and accuracy of system fault locating.

[0048] Embodiment 2

[0049] Figure 2 This is a flowchart of an alarm data processing method provided in Example 2 of the present invention. Based on the above example, this example further optimizes "determining target alarm data from candidate alarm data in the search data analysis engine according to a data search request" and provides an optional implementation plan. It should be noted that for the parts not described in detail in the example of the present invention, reference can be made to the relevant descriptions of other examples. Figure 2 As shown, the method includes:

[0050] S201. Determine a first search condition according to a search time range, an alarm type, an alarm source, and an alarm application name in a data search request.

[0051] The search time range refers to the time range specified by the demander in the data search request; optionally, the search time range includes a start time and an end time. The demander refers to a party who wants to search for system alarm data from the search data analysis engine. The first search condition refers to the text query condition required to determine the target alarm data.

[0052] Specifically, the search time range, alarm type, alarm source and alarm application name in the data search request may be converted into the first search condition according to the query grammar rules specified by the search data analysis engine.

[0053] For example, if the search time range in the data search request is: December 1, 2024 to December 10, 2024, the alarm type is equipment failure, the alarm source is camera A, and the alarm application name is security monitoring system A; the search data analysis engine is Elasticsearch, and its specified query syntax rules are: DSL (Domain Specific Language) query language based on JSON (JavaScript Object Notation, JavaScript object representation) style. Based on the above content, the following first search condition is obtained:

[0054] {"bool":{"filter":[{"range":{"warnDate":"format":"epoch_millis","gte":"2024-12-01","lte":"2024-12-01"}}},{"query_string":{"query":"warnSource:Camera A AND appName:Security Monitoring System A AND warnType:Equipment Failure","analyze_wildcard":true}}]}}

[0055] Among them, warnDate indicates the alarm time; format indicates the format of the alarm time; epoch_millis indicates that the value of the alarm time retains the millisecond value; gte indicates the start time; lte indicates the end time; warnSource indicates the alarm source; appName indicates the alarm application name; warnType indicates the alarm type; analyze_wildcard indicates whether to analyze the wildcard.

[0056] S202: Determine a second search condition according to the search quantity requirement in the data search request.

[0057] The search quantity requirement refers to the number of system alarm data required by the demander. The second search condition refers to the data aggregation condition required to determine the target alarm data.

[0058] Specifically, the search quantity requirement in the data search request may be converted into the second search condition according to the query grammar rules specified by the search data analysis engine.

[0059] For example, if the search quantity requirement in the data search request is: the number of departments involved is 5, the search data analysis engine is Elasticsearch, and its prescribed query syntax rule is: DSL query language based on JSON style. Based on the above content, the following second search condition is obtained:

[0060] "aggs":{"Department aggregation":{"terms":{"field":"original.dep.keyword","size":5,"min_doc_count":1,"order":{"_count":"desc"}}

[0061] Among them, field represents the name of the field to be aggregated; original.dep.keyword represents the department field name; min_doc_count means that a department will be included in the result only when it appears in at least one system alarm data.

[0062] S203: Generate a data screening statement according to the first search condition and the second search condition.

[0063] The data screening statement refers to a query statement used to screen out target alarm data from candidate alarm data in the search data analysis engine.

[0064] Specifically, the first search condition and the second search condition may be combined and processed according to a certain logic operation sequence to obtain a data screening statement.

[0065] Based on the first search condition and the second search condition in the above example, the first search condition and the second search condition in the above example are combined in the logical operation order of the first search condition first and the second search condition second, and the following data screening statement is obtained:

[0066] {"size":0,"query":{"bool":{"filter":[{"range":{"warnDate":"format":"epoch_millis","gte":"2024-12-01","lte":"2024-12-01"}}},{"query_string":{"query":"warnSource:Camera A AND appName:Security Monitoring System A AND warnType:Equipment Failure","analyze_wildcard":true}}]}},"aggs":{"Department Aggregation":{"terms":{"field":"original.dep.keyword","size":5,"min_doc_count":1,"order":{"_count":"desc"}}}}}}}}}

[0067] S204: Filter out target alarm data from candidate alarm data in the search data analysis engine according to the data filtering statement.

[0068] Specifically, a data screening statement may be executed in the search data analysis engine, thereby screening out target alarm data from candidate alarm data in the search data analysis engine.

[0069] Optionally, after the target alarm data is screened out from the candidate alarm data in the search data analysis engine, the target alarm data may also be visualized.

[0070] Specifically, the target alarm data can be visualized with the help of the visualization tools provided by the search data analysis engine, so that the demander can understand the target alarm data more intuitively and clearly.

[0071] S205 , inputting the target alarm data into the waveform conversion model to obtain the target waveform data corresponding to the target alarm data.

[0072] Among them, the waveform conversion model is obtained by training the recurrent neural network model.

[0073] S206 , performing waveform detection on the target waveform data to obtain a target abnormality pattern corresponding to the target waveform data.

[0074] S207: Determine the fault type corresponding to the target alarm data according to the target abnormal mode.

[0075] Specifically, the fault type corresponding to the target alarm data may be determined from the candidate fault types in the fault type library according to the target abnormal pattern and based on the correspondence between the candidate abnormal patterns and the candidate fault types in the fault type library.

[0076] Among them, the fault type library refers to a database used to record the correspondence between system fault types and waveform abnormal patterns; optionally, the fault type library can be pre-set according to the expert experience of technicians in this field and the historical fault types corresponding to the historical waveform abnormal patterns, which is not specifically limited in the embodiment of the present invention. The candidate abnormal pattern refers to the waveform abnormal pattern stored in the fault type library. The candidate fault type refers to the system fault type stored in the fault type library.

[0077] Specifically, taking the target abnormal pattern as an index, a candidate abnormal pattern that matches the target abnormal pattern is determined from the candidate abnormal patterns in the fault type library as the matching abnormal pattern; based on the correspondence between the candidate abnormal patterns and the candidate fault types in the fault type library, a candidate fault type corresponding to the matching abnormal pattern is determined from the candidate fault types in the fault type library, and is used as the fault type corresponding to the target alarm data.

[0078] It can be understood that according to the target abnormal pattern, based on the correspondence between the candidate abnormal pattern and the candidate fault type in the fault type library, the fault type corresponding to the target alarm data is determined from the candidate fault types in the fault type library. After obtaining the target abnormal pattern, the fault type corresponding to the target alarm data can be determined more quickly and accurately, thereby improving the efficiency and accuracy of fault type determination.

[0079] Optionally, after determining the fault type corresponding to the target alarm data, the fault type corresponding to the target alarm data can also be sent to relevant staff to reduce the troubleshooting pressure of the relevant staff and help the relevant staff to timely and targetedly handle the system fault, thereby improving the maintenance efficiency of the system fault, reducing the system interruption time, and further improving the service availability of the system. The relevant staff can be system operation and maintenance personnel or system management personnel.

[0080] The technical solution of the embodiment of the present invention determines a first search condition according to a search time range, alarm type, alarm source and alarm application name in a data search request; determines a second search condition according to a search quantity requirement in the data search request; generates a data filtering statement according to the first search condition and the second search condition; filters out target alarm data from candidate alarm data in a search data analysis engine according to the data filtering statement; inputs the target alarm data into a waveform conversion model to obtain target waveform data corresponding to the target alarm data; performs waveform detection on the target waveform data to obtain a target abnormality pattern corresponding to the target waveform data; and determines a fault type corresponding to the target alarm data according to the target abnormality pattern. The above technical solution generates the first search condition and the second search condition according to the key content extracted from the data search request, and further generates the data screening statement according to the first search condition and the second search condition, so that the target alarm data obtained based on the data screening statement is more accurate and more in line with the actual search needs; secondly, according to the data screening statement, with the help of the powerful data search and analysis capabilities of the search data analysis engine, the target alarm data is screened out from the candidate alarm data in the search data analysis engine, which improves the determination speed of the target alarm data and speeds up the determination speed of the fault type corresponding to the subsequent target alarm data; furthermore, the target alarm data is converted into the target waveform data with the help of the waveform conversion model, which more intuitively displays the target alarm data; then, by performing waveform detection on the target waveform data, the target abnormal mode corresponding to the target waveform data is obtained; and according to the target abnormal mode, the fault type corresponding to the target alarm data is determined, which improves the accuracy of the fault type corresponding to the target alarm data. In summary, the above technical solution improves the efficiency and accuracy of system fault location.

[0081] Embodiment 3

[0082] Figure 3 This is a schematic diagram of the structure of an alarm data processing device provided in the third embodiment of the present invention. This embodiment is applicable to the situation where a system fault is located based on a large amount of system alarm data. The device can be implemented in the form of hardware and / or software and can be configured in an electronic device. Figure 3 As shown, the device comprises:

[0083] The target alarm data determination module 301 is used to determine the target alarm data from the candidate alarm data in the search data analysis engine according to the data search request;

[0084] The target waveform data determination module 302 is used to input the target alarm data into the waveform conversion model to obtain the target waveform data corresponding to the target alarm data; wherein the waveform conversion model is obtained by training a recurrent neural network model;

[0085] A target abnormal pattern determination module 303 is used to perform waveform detection on the target waveform data to obtain a target abnormal pattern corresponding to the target waveform data;

[0086] The fault type determination module 304 is used to determine the fault type corresponding to the target alarm data according to the target abnormal mode.

[0087] The technical solution of the embodiment of the present invention is to determine the target alarm data from the candidate alarm data in the search data analysis engine according to the data search request; input the target alarm data into the waveform conversion model to obtain the target waveform data corresponding to the target alarm data; wherein the waveform conversion model is obtained by training the recurrent neural network model; waveform detection is performed on the target waveform data to obtain the target abnormal mode corresponding to the target waveform data; and the fault type corresponding to the target alarm data is determined according to the target abnormal mode. The above technical solution uses the search data analysis engine to store the system alarm data in financial institutions such as banks, and after receiving the data search request, the search data analysis engine uses the powerful data search and analysis capabilities to directly determine the target alarm data from the candidate alarm data in the search data analysis engine according to the data search request, thereby improving the determination speed and accuracy of the target alarm data and accelerating the determination speed of the fault type corresponding to the subsequent target alarm data; secondly, the target alarm data is converted into the target waveform data by means of the waveform conversion model, which more intuitively displays the target alarm data; furthermore, the target waveform data is detected by waveform detection to obtain the target abnormal mode corresponding to the target waveform data; and the fault type corresponding to the target alarm data is determined according to the target abnormal mode, thereby improving the accuracy of the fault type corresponding to the target alarm data. In summary, the above technical solution improves the efficiency and accuracy of system fault location.

[0088] Optionally, the target alarm data determination module 301 is specifically used to:

[0089] Determine a first search condition according to a search time range, an alarm type, an alarm source, and an alarm application name in the data search request;

[0090] Determining a second search condition according to a search quantity requirement in the data search request;

[0091] Generate a data screening statement according to the first search condition and the second search condition;

[0092] According to the data filtering statement, the target alarm data is filtered out from the candidate alarm data in the search data analysis engine.

[0093] Optionally, the device further comprises:

[0094] The data visualization module is used to visualize the target alarm data after filtering out the target alarm data from the candidate alarm data in the search data analysis engine.

[0095] Optionally, the target abnormal pattern determination module 303 is specifically used to:

[0096] The target waveform data is subjected to waveform detection by a preset waveform detection algorithm to obtain a target abnormality pattern corresponding to the target waveform data.

[0097] Optionally, the fault type determination module 304 is specifically configured to:

[0098] According to the target abnormal pattern, based on the correspondence between the candidate abnormal patterns and the candidate fault types in the fault type library, the fault type corresponding to the target alarm data is determined from the candidate fault types in the fault type library.

[0099] Optionally, the device further comprises:

[0100] The fault type sending module is used to send the fault type corresponding to the target alarm data to relevant staff.

[0101] The alarm data processing device provided in the embodiment of the present invention can execute the alarm data processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing each alarm data processing method.

[0102] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0103] Embodiment 4

[0104] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0105] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, ROM 12 and RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0106] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0107] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the alarm data processing method.

[0108] In some embodiments, the alarm data processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the alarm data processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the alarm data processing method in any other appropriate manner (e.g., by means of firmware).

[0109] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0110] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0111] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0112] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0113] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0114] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0115] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0116] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing alarm data, characterized in that: include: According to the data search request, determine the target alarm data from the candidate alarm data in the search data analysis engine; Inputting the target alarm data into a waveform conversion model to obtain target waveform data corresponding to the target alarm data; wherein the waveform conversion model is obtained by training a recurrent neural network model; Performing waveform detection on the target waveform data to obtain a target abnormality pattern corresponding to the target waveform data; According to the target abnormal mode, a fault type corresponding to the target alarm data is determined.

2. The method according to claim 1, characterized in that: The step of determining target alarm data from candidate alarm data in a search data analysis engine according to a data search request includes: Determine a first search condition according to a search time range, an alarm type, an alarm source, and an alarm application name in the data search request; Determining a second search condition according to a search quantity requirement in the data search request; Generate a data screening statement according to the first search condition and the second search condition; According to the data screening statement, target alarm data is screened out from candidate alarm data in the search data analysis engine.

3. The method according to claim 2, characterized in that After selecting the target alarm data from the candidate alarm data in the search data analysis engine, the following steps are also included: The target alarm data is displayed visually.

4. The method according to claim 1, characterized in that: The performing waveform detection on the target waveform data to obtain a target abnormality pattern corresponding to the target waveform data includes: The target waveform data is subjected to waveform detection by a preset waveform detection algorithm to obtain a target abnormality pattern corresponding to the target waveform data.

5. The method according to claim 1, characterized in that The determining, according to the target abnormal mode, the fault type corresponding to the target alarm data includes: According to the target abnormal pattern, based on the correspondence between the candidate abnormal patterns and the candidate fault types in the fault type library, the fault type corresponding to the target alarm data is determined from the candidate fault types in the fault type library.

6. The method according to claim 1, characterized in that The method further comprises: The fault type corresponding to the target alarm data is sent to relevant staff.

7. An alarm data processing device, characterized in that: include: A target alarm data determination module is used to determine target alarm data from candidate alarm data in the search data analysis engine according to a data search request; A target waveform data determination module, used for inputting the target alarm data into a waveform conversion model to obtain target waveform data corresponding to the target alarm data; wherein the waveform conversion model is obtained by training a recurrent neural network model; A target abnormal pattern determination module, used for performing waveform detection on the target waveform data to obtain a target abnormal pattern corresponding to the target waveform data; The fault type determination module is used to determine the fault type corresponding to the target alarm data according to the target abnormal mode.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm data processing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm data processing method according to any one of claims 1 to 6 when executed.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the alarm data processing method according to any one of claims 1 to 6 is implemented.

Images