Alarm information processing method and device
Through the trained classification model and processing strategy library, the bank's network attack alarm information is automatically processed, and the problem of inefficient alarm processing is solved and faster network security response is achieved.
Patent Information
- Application Number
- CN202411848684.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-16
- Publication Date
- 2025-03-28
AI Technical Summary
When handling cyber attack alarms, banks need to coordinate and confirm with multiple parties, resulting in inefficient processing.
By obtaining the pending alarm information, input it into the trained classification model, obtaining the alarm classification results, and obtaining the corresponding processing strategy from the processing policy library based on the analysis results, and automatically performing alarm information processing.
It reduces the time for manual intervention and judgment, improves the efficiency of alarm information processing, and improves the speed of network security response.
Smart Images
Figure CN119728392A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data processing technology, and in particular to a method and device for processing alarm information. Background Art
[0002] As financial institutions, banks are subject to strict regulatory requirements and have great social influence, making them the main targets of cyber attacks and defenses.
[0003] Currently, after receiving a network attack alert, banks need to contact security personnel to manually block IP addresses and other operations to ensure network security. However, if coordination is required between security personnel and other departments (such as network operation and maintenance, IT support, etc.), or if multiple parties need to confirm the specific attack source or threat type, it often takes a lot of time, resulting in inefficient processing of alert information.
[0004] Therefore, how to improve the processing efficiency of alarm information has become an urgent problem to be solved in this field. Summary of the invention
[0005] The present application provides a method and device for processing alarm information, aiming to improve the efficiency of alarm information processing.
[0006] In order to achieve the above objectives, this application provides the following technical solutions:
[0007] A method for processing alarm information, comprising:
[0008] Get pending alarm information;
[0009] Inputting the alarm information to be processed into a trained classification model to obtain an alarm classification result; the trained classification model is obtained by training the classification model based on the sample alarm information; the trained classification model includes a feature weight module, a standardization module, and a classification module;
[0010] Analyze the alarm classification result to obtain an analysis result;
[0011] Acquire a processing strategy corresponding to the analysis result from a processing strategy library;
[0012] The to-be-processed alarm information is processed using the processing strategy corresponding to the analysis result to obtain a processing result.
[0013] Optionally, the inputting the alarm information to be processed into a trained classification model to obtain an alarm classification result includes:
[0014] Inputting the to-be-processed alarm information into a feature weight module to obtain a plurality of feature vectors; the feature vectors include feature weights;
[0015] Inputting the plurality of feature vectors into a standardization module to obtain a plurality of standardized feature vectors;
[0016] Combine all the standardized feature vectors to obtain a combined feature vector;
[0017] The combined feature vector is input into a classification module to obtain an alarm classification result.
[0018] Optionally, the process of training the classification model based on the sample alarm information to obtain the trained classification model includes:
[0019] Get sample alarm information;
[0020] Performing a weight assignment on each feature in the sample alarm information to obtain assigned sample alarm information;
[0021] Performing data preprocessing on the allocated sample alarm information to obtain preprocessed sample alarm information;
[0022] Filter out alarm classification features from the sample alarm information preprocessed by recursive elimination features;
[0023] Inputting the alarm classification features into the classification model to obtain a sample alarm classification result;
[0024] Calculating the error between the sample alarm classification result and the actual alarm classification result corresponding to the sample alarm information to obtain a loss function;
[0025] Determining whether the loss function converges;
[0026] If the loss function does not converge, the model parameters of the classification model are adjusted, and the step of inputting the alarm classification features into the classification model to obtain a sample alarm classification result is returned;
[0027] If the loss function converges, the classification model is determined as the trained classification model.
[0028] Optionally, the using the processing strategy corresponding to the analysis result to process the alarm information to be processed to obtain a processing result includes:
[0029] generating a control signal based on the processing strategy corresponding to the analysis result;
[0030] The control signal is sent to the device via the IP address, so that the device processes the alarm information to be processed and obtains a processing result.
[0031] Optionally, before sending the control signal to a device through an IP address so that the device processes the alarm information to be processed and obtaining a processing result, the method further includes:
[0032] Obtaining an IP address of a device corresponding to the control signal;
[0033] For each IP address of the device, detecting the IP address of the device;
[0034] If it is detected that there is a conflict in the IP address of the device, or there is an abnormality in the IP address of the device, the IP address of the device with the abnormality or conflict is reallocated to obtain a new IP address of the device;
[0035] Verifying the new IP address of the device;
[0036] When the new IP address of the device passes the verification, the control signal is sent to the device through the IP address, so that the device processes the alarm information to be processed and obtains a processing result.
[0037] A device for processing alarm information, comprising:
[0038] A first acquisition unit, used to acquire the alarm information to be processed;
[0039] An input unit, used for inputting the alarm information to be processed into a trained classification model to obtain an alarm classification result; the trained classification model is obtained by training the classification model based on the sample alarm information; the trained classification model includes a feature weight module, a normalization module, and a classification module;
[0040] An analysis unit, used to analyze the alarm classification result to obtain an analysis result;
[0041] A second acquisition unit, configured to acquire a processing strategy corresponding to the analysis result from a processing strategy library;
[0042] The processing unit is used to process the alarm information to be processed by using the processing strategy corresponding to the analysis result to obtain a processing result.
[0043] Optionally, the input unit is specifically used for:
[0044] Inputting the to-be-processed alarm information into a feature weight module to obtain a plurality of feature vectors; the feature vectors include feature weights;
[0045] Inputting the plurality of feature vectors into a standardization module to obtain a plurality of standardized feature vectors;
[0046] Combine all the standardized feature vectors to obtain a combined feature vector;
[0047] The combined feature vector is input into a classification module to obtain an alarm classification result.
[0048] Optionally, the input unit is specifically used for:
[0049] Get sample alarm information;
[0050] Performing a weight assignment on each feature in the sample alarm information to obtain assigned sample alarm information;
[0051] Performing data preprocessing on the allocated sample alarm information to obtain preprocessed sample alarm information;
[0052] Filter out alarm classification features from the sample alarm information preprocessed by recursive elimination features;
[0053] Inputting the alarm classification features into the classification model to obtain a sample alarm classification result;
[0054] Calculating the error between the sample alarm classification result and the actual alarm classification result corresponding to the sample alarm information to obtain a loss function;
[0055] Determining whether the loss function converges;
[0056] If the loss function does not converge, the model parameters of the classification model are adjusted, and the step of inputting the alarm classification features into the classification model to obtain a sample alarm classification result is returned;
[0057] If the loss function converges, the classification model is determined as the trained classification model.
[0058] Optionally, the processing unit is specifically used for:
[0059] generating a control signal based on the processing strategy corresponding to the analysis result;
[0060] The control signal is sent to the device via the IP address, so that the device processes the alarm information to be processed and obtains a processing result.
[0061] Optionally, also include:
[0062] A third acquisition unit, configured to acquire an IP address of a device corresponding to the control signal;
[0063] a detection unit, configured to detect the IP address of each device;
[0064] an allocating unit, configured to reallocate an IP address to the device with the abnormal or conflicting IP address to obtain a new IP address of the device if a conflict is detected in the IP address of the device or an abnormality is detected in the IP address of the device;
[0065] A verification unit, used to verify the new IP address of the device;
[0066] The target processing unit is used to execute the sending of the control signal to the device through the IP address when the new IP address of the device passes the verification, so that the device processes the alarm information to be processed and obtains a processing result.
[0067] The technical solution provided by the present application obtains the alarm information to be processed; inputs the alarm information to be processed into a trained classification model to obtain the alarm classification result; analyzes the alarm classification result to obtain the analysis result; obtains the processing strategy corresponding to the analysis result from the processing strategy library; uses the processing strategy corresponding to the analysis result to process the alarm information to be processed to obtain the processing result. In the present application, after the alarm classification result is analyzed, the corresponding processing strategy can be automatically matched from the processing strategy library, and then the alarm information is processed by matching the processing strategy, thereby reducing the time of manual intervention and judgment and improving the processing efficiency of the alarm information. BRIEF DESCRIPTION OF THE DRAWINGS
[0068] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0069] Figure 1 A flowchart of a method for processing alarm information provided in an embodiment of the present application;
[0070] Figure 2 A flowchart of a method for classifying alarm information provided in an embodiment of the present application;
[0071] Figure 3 A flowchart of a classification model training method provided in an embodiment of the present application;
[0072] Figure 4 A flowchart of a method for processing unprocessed alarm information provided in an embodiment of the present application;
[0073] Figure 5 A flowchart of another method for processing unprocessed alarm information provided in an embodiment of the present application;
[0074] Figure 6 A schematic diagram of the architecture of an alarm information processing device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0075] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0076] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.
[0077] like Figure 1 FIG. 1 is a flowchart of a method for processing alarm information provided by an embodiment of the present application, comprising the following steps:
[0078] S101: Obtaining alarm information to be processed.
[0079] Among them, the alarm information to be processed includes multiple features, such as alarm type (such as network failure, device abnormality, security attack, etc.), source (such as specific device IP address, device type, etc.), priority (such as high, medium, low, etc.), timestamp, and alarm description.
[0080] S102: Input the alarm information to be processed into the trained classification model to obtain the alarm classification result.
[0081] The trained classification model is obtained by training the classification model based on sample alarm information; the trained classification model includes a feature weight module, a standardization module, and a classification module.
[0082] Optionally, the alarm classification result indicates the alarm level of the alarm information to be processed, for example, general alarm, important alarm, emergency alarm.
[0083] Optionally, in another embodiment of the present application, the specific implementation of step S102 is as follows: Figure 2 As shown, the following steps are included:
[0084] S201: Input the alarm information to be processed into a feature weight module to obtain multiple feature vectors.
[0085] The feature vector includes features and feature weights.
[0086] It can be understood that the alarm information to be processed is input into the feature weight module, and the feature weight module extracts features from the alarm information to be processed to obtain multiple features; for each feature, a weight is assigned to the feature to obtain the weight of the feature; based on the features and the weights of the features, a feature vector is generated.
[0087] S202: Input a plurality of feature vectors into a standardization module to obtain a plurality of standardized feature vectors.
[0088] It should be noted that when multiple feature vectors are input into the standardization module, when the feature vector is a category feature (such as alarm type, source), the standardization module uses label encoding and expert experience to transform the feature vector, maps the feature vector to an integer, and obtains a standardized feature vector, such as 1 for network failure, 2 for device abnormality, and 3 for security attack. When the feature vector is a numerical feature (such as a timestamp), the standardization module uses the Z-score standardization method to transform the feature vector to obtain a standardized feature vector.
[0089] It should be noted that the purpose of normalization is to make different features have the same scale so that subsequent algorithms can compare them fairly.
[0090] S203: Combining all the standardized feature vectors to obtain a combined feature vector.
[0091] It can be understood that all the standardized feature vectors are combined to obtain a combined feature vector, each dimension of which corresponds to a feature value. The combined feature vector will be used as the coordinate of the alarm information in the multidimensional space for the subsequent classification algorithm.
[0092] S204: Input the combined feature vector into a classification module to obtain an alarm classification result.
[0093] It can be understood that the combined feature vector is input into the classification module, and the classification module converts the category of each feature in the combined feature vector into a numerical value through the feature weight and note coding method. The numerical value can be expressed as the distance from the origin on the one-dimensional coordinate axis. The larger the numerical value, the more important the alarm category is, and the alarm classification result is determined according to the numerical value.
[0094] It should be noted that in the model training phase, each different feature vector is listed by enumeration, and then the feature vector is clustered using the K-MEANS method to obtain the number of clusters. Based on the clustering results and the numerical representation of the feature vector, the classification module can more accurately identify the alarm type and assign appropriate categories to each alarm, thereby achieving effective classification and priority sorting of alarms.
[0095] For example, the feature vector contains 4 features, and each feature has 4, 5, 3, and 2 categories respectively. Then there are a total of 4*5*3*2=120 feature vectors. The 120 feature vectors are converted into numerical values through feature weights and note coding methods. The numerical value can be expressed as the distance from the origin on a one-dimensional coordinate axis. The larger the value, the more important the alarm category. K-MEANS is used to divide the 120 feature vectors into 3 categories, namely the alarm levels.
[0096] In addition, the number of clusters can be increased to increase the classification accuracy. The alarm classification results can also be displayed on the system interface in a clear and concise manner. Different types of alarms can be distinguished by color, icons or text, so that managers can quickly identify and handle them. At the same time, the model can also output the predicted probability of each classification, providing managers with more decision-making basis.
[0097] Optionally, in another embodiment of the present application, a specific implementation method of training a classification model based on sample alarm information to obtain a trained classification model is as follows: Figure 3 As shown, the following steps are included:
[0098] S301: Obtain sample alarm information.
[0099] Among them, the Trap method of the Simple Network Management Protocol can be used to collect sample alarm information. Each sample alarm information contains multiple features, such as alarm type (such as network failure, equipment abnormality, security attack, etc.), source (such as specific device IP address, device type, etc.), priority (such as high, medium, low, etc.), timestamp, alarm description, etc.
[0100] S302: Assign weights to each feature in the sample alarm information to obtain assigned sample alarm information.
[0101] It should be noted that the purpose of weighting each feature in the sample alarm information is to reflect the importance of each feature in the alarm judgment, optimize the model performance, and improve the classification accuracy. Through reasonable weight allocation, the model can pay more attention to the features that have a significant impact on the alarm processing, reflect the domain knowledge, and improve the accuracy and efficiency. In addition, weight allocation helps to simplify the processing process, reduce the computational complexity, and continuously optimize the decision-making strategy through adaptive learning, thereby improving the response speed and overall effect of the alarm system.
[0102] S303: Perform data preprocessing on the allocated sample alarm information to obtain preprocessed sample alarm information.
[0103] Among them, the allocated sample alarm information undergoes data preprocessing, including removing duplicate data, processing missing values, and detecting and processing outliers.
[0104] S304: Filter out alarm classification features from the sample alarm information preprocessed by recursive elimination of features.
[0105] Among them, the alarm classification features include but are not limited to: timestamp, alarm source, alarm type, error code, impact range, and status information.
[0106] Timestamp: The time when the alarm occurred. It helps to understand the time context of the problem and is very important for troubleshooting and log analysis.
[0107] Alarm source: The identifier of the device, system, or application that triggered the alarm.
[0108] Alarm Type: The specific type of alarm, such as hardware failure, software error, network anomaly, security attack, etc., helps administrators understand the nature of the problem.
[0109] Impact scope: The scope of devices, services, or users affected by the alarm, which helps to assess the severity and impact of the problem.
[0110] Status information: The system or device status when the alarm occurs, such as CPU usage, memory usage, network bandwidth, etc., which helps analyze the cause of the problem.
[0111] S305: Input the alarm classification features into the classification model to obtain the sample alarm classification results.
[0112] Optionally, the classification model includes but is not limited to: random forest algorithm. The number of trees is set to 100, the maximum depth is 50, the minimum split sample is 11, the minimum number of leaf nodes is 10, the number of features is set to default, and random sampling with replacement is used.
[0113] S306: Calculate the error between the sample alarm classification result and the actual alarm classification result corresponding to the sample alarm information to obtain a loss function.
[0114] It is understandable that the root mean square error between the sample alarm classification result and the actual alarm classification result corresponding to the sample alarm information may be calculated, and the root mean square error may be determined as the loss function.
[0115] S307: Determine whether the loss function converges.
[0116] If the loss function has not converged, step S308 is executed; if the loss function has converged, step S309 is executed.
[0117] It can be understood that whether the loss function converges is judged. If the loss function converges, that is, the loss function gradually decreases with the increase of training steps, and finally tends to be stable or no longer changes significantly, it means that the classification model training is completed at this time.
[0118] S308: Adjust the model parameters of the classification model, and return to execute step S305.
[0119] It should be noted that if the loss function does not converge, it means that the loss function does not decrease with the increase of training steps. At this time, the model parameters in the classification model are adjusted, and the process returns to step S305 until the loss function converges.
[0120] S309: Determine the classification model as a trained classification model.
[0121] S103: Analyze the alarm classification result to obtain an analysis result.
[0122] The analysis results include alarm type, IP address, device ID, and alarm level.
[0123] S104: Acquire a processing strategy corresponding to the analysis result from a processing strategy library.
[0124] It can be understood that the processing policy library stores all predefined processing policies (such as restarting the device, reallocating IP addresses, and banning IP addresses). The processing policy corresponding to the analysis result is obtained from the processing policy library, and when multiple processing policies are matched, they are processed in sequence according to the pre-defined priority.
[0125] S105: Using the processing strategy corresponding to the analysis result, the alarm information to be processed is processed to obtain a processing result.
[0126] The processing result indicates whether the alarm has been eliminated or restored.
[0127] It is understandable that after the processing results are obtained, the pending alarm information and processing results are pushed to the management personnel. Through mobile terminals (such as mobile phones, tablets, etc.), managers can view the system alarms anytime and anywhere and understand the operating status of the equipment. The module also supports custom push content, push frequency, etc. to meet the needs of different managers.
[0128] Optionally, in another embodiment of the present application, the specific implementation of step S105 is as follows: Figure 4 As shown, the following steps are included:
[0129] S401: Generate a control signal based on a processing strategy corresponding to the analysis result.
[0130] The control signal includes, but is not limited to, a restart instruction, an IP address change instruction, and an isolation instruction.
[0131] S402: Send a control signal to the device via the IP address, so that the device processes the alarm information to be processed and obtains a processing result.
[0132] It can be understood that, through the IP address of the device, the control signal is sent to the device through the network, so that the device performs a specific processing operation.
[0133] Optionally, in another embodiment of the present application, the specific implementation of step S105 is as follows: Figure 5 As shown, the following steps are included:
[0134] S501: Generate a control signal based on a processing strategy corresponding to the analysis result.
[0135] It should be noted that the specific implementation of step S501 may refer to step S401 accordingly, and will not be described in detail here.
[0136] S502: Acquire the IP address of the device corresponding to the control signal.
[0137] S503: For each device's IP address, detect the device's IP address.
[0138] It is understandable that for each device's IP address, the device's IP address is detected, that is, whether there is an address conflict or an address anomaly (such as inaccessibility, response timeout, etc.) between the device's IP addresses.
[0139] S504: If it is detected that there is a conflict in the IP address of the device, or there is an abnormality in the IP address of the device, the IP address of the device with the abnormality or conflict is reallocated to obtain a new IP address of the device.
[0140] If a conflict is detected in the device's IP address, or if the device's IP address is abnormal, a new, unused IP address is selected from the available IP address pool. This address pool is usually pre-configured by the system administrator and contains the available IP address range. Once a new IP address is selected, the module will update the network configuration and assign the new IP address to the corresponding device.
[0141] Optionally, updating the IP may involve updating the device's network settings, DNS records, routing tables, etc.
[0142] It should be noted that after reallocating the IP address, the module will notify related systems or services, such as DHCP servers, firewalls, load balancers, etc., to ensure that they can recognize and correctly handle the new IP address.
[0143] S505: Verify the new IP address of the device.
[0144] It is understandable that the new IP address of the device is verified. Specifically, the automated verification process is triggered and executed through the API interface, that is, the automated script is executed, and the PING and Traceroute commands are used to verify whether the network is unobstructed, and the new IP appears in the network routing table to verify its validity, and check whether the device can access the network normally.
[0145] It should be noted that if the verification fails, the module may fall back to the previous processing strategy or trigger further troubleshooting process.
[0146] It is important to emphasize that the alarm processing process and the alarm classification process are parallel. When an anomaly is detected and an alarm is generated, the analysis of these alarms and the preparation of corresponding processing strategies are almost started at the same time. This parallelism ensures that the system can respond to alarms quickly and reduce processing delays.
[0147] S506: When the new IP address of the device passes the verification, a control signal is sent to the device through the IP address, so that the device processes the alarm information to be processed and obtains a processing result.
[0148] It should be noted that the specific implementation of step S506 may refer to step S402 accordingly, and will not be described in detail here.
[0149] To sum up, after the alarm classification results are analyzed, the corresponding processing strategies can be automatically matched from the processing strategy library, and then the alarm information can be processed by matching the processing strategies, thereby reducing the time of manual intervention and judgment and improving the processing efficiency of alarm information.
[0150] like Figure 6, which is a schematic diagram of the architecture of an alarm information processing device provided in an embodiment of the present application, the processing device includes: a first acquisition unit 100, an input unit 200, an analysis unit 300, a second acquisition unit 400 and a processing unit 500.
[0151] The first acquisition unit 100 is used to acquire the alarm information to be processed.
[0152] The input unit 200 is used to input the alarm information to be processed into the trained classification model to obtain the alarm classification result; the trained classification model is trained based on the sample alarm information; the trained classification model includes a feature weight module, a standardization module, and a classification module.
[0153] The input unit 200 is specifically used for: inputting the alarm information to be processed into the feature weight module to obtain multiple feature vectors; the feature vector includes the weight of the feature; inputting the multiple feature vectors into the standardization module to obtain multiple standardized feature vectors; combining all the standardized feature vectors to obtain a combined feature vector; inputting the combined feature vector into the classification module to obtain the alarm classification result.
[0154] The input unit 200 is specifically used to: obtain sample alarm information; assign weights to each feature in the sample alarm information to obtain assigned sample alarm information; perform data preprocessing on the assigned sample alarm information to obtain preprocessed sample alarm information; screen out alarm classification features from the preprocessed sample alarm information by recursively eliminating features; input the alarm classification features into the classification model to obtain a sample alarm classification result; calculate the error between the sample alarm classification result and the actual alarm classification result corresponding to the sample alarm information to obtain a loss function; determine whether the loss function converges; if the loss function does not converge, adjust the model parameters of the classification model, and return to execute the step of inputting the alarm classification features into the classification model to obtain the sample alarm classification result; if the loss function converges, determine the classification model as a trained classification model.
[0155] The analysis unit 300 is used to analyze the alarm classification result to obtain an analysis result.
[0156] The second acquisition unit 400 is used to acquire a processing strategy corresponding to the analysis result from a processing strategy library.
[0157] The processing unit 500 is used to process the alarm information to be processed by using a processing strategy corresponding to the analysis result to obtain a processing result.
[0158] The processing unit 500 is specifically used to: generate a control signal based on a processing strategy corresponding to the analysis result; and send the control signal to the device via the IP address so that the device processes the alarm information to be processed and obtains a processing result.
[0159] To sum up, after the alarm classification results are analyzed, the corresponding processing strategies can be automatically matched from the processing strategy library, and then the alarm information can be processed by matching the processing strategies, thereby reducing the time of manual intervention and judgment and improving the processing efficiency of alarm information.
[0160] Preferably, combined Figure 6 According to the content shown, the processing device also includes: a third acquisition unit, a detection unit, an allocation unit, a verification unit and a target processing unit.
[0161] The third acquisition unit is used to acquire the IP address of the device corresponding to the control signal.
[0162] The detection unit is used to detect the IP address of each device.
[0163] The allocation unit is used to reallocate the IP address of the device with the abnormal or conflicting IP address to obtain a new IP address of the device if it is detected that the IP address of the device has a conflict or an abnormality.
[0164] The verification unit is used to verify the new IP address of the device.
[0165] The target processing unit is used to execute sending a control signal to the device through the IP address when the new IP address of the device passes the verification, so that the device processes the alarm information to be processed and obtains the processing result.
[0166] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.
[0167] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0168] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for processing alarm information, characterized in that: include: Get pending alarm information; Inputting the alarm information to be processed into the trained classification model to obtain an alarm classification result; The trained classification model is obtained by training the classification model based on sample alarm information; The trained classification model includes a feature weight module, a standardization module, and a classification module; Analyze the alarm classification result to obtain an analysis result; Acquire a processing strategy corresponding to the analysis result from a processing strategy library; The to-be-processed alarm information is processed using the processing strategy corresponding to the analysis result to obtain a processing result.
2. The method according to claim 1, characterized in that: The step of inputting the alarm information to be processed into a trained classification model to obtain an alarm classification result includes: Inputting the to-be-processed alarm information into a feature weight module to obtain a plurality of feature vectors; the feature vectors include feature weights; Inputting the plurality of feature vectors into a standardization module to obtain a plurality of standardized feature vectors; Combine all the standardized feature vectors to obtain a combined feature vector; The combined feature vector is input into a classification module to obtain an alarm classification result.
3. The method according to claim 1, characterized in that The process of training the classification model based on the sample alarm information to obtain the trained classification model includes: Get sample alarm information; Performing a weight assignment on each feature in the sample alarm information to obtain assigned sample alarm information; Performing data preprocessing on the allocated sample alarm information to obtain preprocessed sample alarm information; Filter out alarm classification features from the sample alarm information preprocessed by recursive elimination features; Inputting the alarm classification features into the classification model to obtain a sample alarm classification result; Calculating the error between the sample alarm classification result and the actual alarm classification result corresponding to the sample alarm information to obtain a loss function; Determining whether the loss function converges; If the loss function does not converge, the model parameters of the classification model are adjusted, and the step of inputting the alarm classification features into the classification model to obtain a sample alarm classification result is returned; If the loss function converges, the classification model is determined as the trained classification model.
4. The method according to claim 1, characterized in that: The using the processing strategy corresponding to the analysis result to process the alarm information to be processed to obtain a processing result includes: generating a control signal based on the processing strategy corresponding to the analysis result; The control signal is sent to the device via the IP address, so that the device processes the alarm information to be processed and obtains a processing result.
5. The method according to claim 4, characterized in that The step of sending the control signal to the device through the IP address so that the device processes the alarm information to be processed and obtaining the processing result further includes: Obtaining an IP address of a device corresponding to the control signal; For each IP address of the device, detecting the IP address of the device; If it is detected that there is a conflict in the IP address of the device, or there is an abnormality in the IP address of the device, the IP address of the device with the abnormality or conflict is reallocated to obtain a new IP address of the device; Verifying the new IP address of the device; When the new IP address of the device passes the verification, the control signal is sent to the device through the IP address, so that the device processes the alarm information to be processed and obtains a processing result.
6. A device for processing alarm information, characterized in that: include: A first acquisition unit, used to acquire the alarm information to be processed; An input unit, used for inputting the alarm information to be processed into a trained classification model to obtain an alarm classification result; the trained classification model is obtained by training the classification model based on sample alarm information; The trained classification model includes a feature weight module, a standardization module, and a classification module; An analysis unit, used to analyze the alarm classification result to obtain an analysis result; A second acquisition unit, configured to acquire a processing strategy corresponding to the analysis result from a processing strategy library; The processing unit is used to process the alarm information to be processed by using the processing strategy corresponding to the analysis result to obtain a processing result.
7. The device according to claim 6, characterized in that The input unit is specifically used for: Inputting the to-be-processed alarm information into a feature weight module to obtain a plurality of feature vectors; the feature vectors include feature weights; Inputting the plurality of feature vectors into a standardization module to obtain a plurality of standardized feature vectors; Combine all the standardized feature vectors to obtain a combined feature vector; The combined feature vector is input into a classification module to obtain an alarm classification result.
8. The device according to claim 6, characterized in that The input unit is specifically used for: Get sample alarm information; Performing a weight assignment on each feature in the sample alarm information to obtain assigned sample alarm information; Performing data preprocessing on the allocated sample alarm information to obtain preprocessed sample alarm information; Filter out alarm classification features from the sample alarm information preprocessed by recursive elimination features; Inputting the alarm classification features into the classification model to obtain a sample alarm classification result; Calculating the error between the sample alarm classification result and the actual alarm classification result corresponding to the sample alarm information to obtain a loss function; Determining whether the loss function converges; If the loss function does not converge, the model parameters of the classification model are adjusted, and the step of inputting the alarm classification features into the classification model to obtain a sample alarm classification result is returned; If the loss function converges, the classification model is determined as the trained classification model.
9. The device according to claim 6, characterized in that The processing unit is specifically used for: generating a control signal based on the processing strategy corresponding to the analysis result; The control signal is sent to the device via the IP address, so that the device processes the alarm information to be processed and obtains a processing result.
10. The device according to claim 9, characterized in that Also includes: A third acquisition unit, configured to acquire an IP address of a device corresponding to the control signal; a detection unit, configured to detect the IP address of each device; an allocating unit, configured to reallocate an IP address to the device with the abnormal or conflicting IP address to obtain a new IP address of the device if a conflict is detected in the IP address of the device or an abnormality is detected in the IP address of the device; A verification unit, used to verify the new IP address of the device; The target processing unit is used to execute the sending of the control signal to the device through the IP address when the new IP address of the device passes the verification, so that the device processes the alarm information to be processed and obtains a processing result.