Alarm storm suppression method, device, equipment and medium based on cluster information

Abstract

The present application relates to a method, device, equipment and medium for suppressing an alarm storm based on cluster information, wherein the method includes: obtaining parent-child cluster information and alarm information corresponding to the parent-child cluster information, constructing an alarm information sample set according to the parent-child cluster information and the alarm information; generating a suppression result sample set corresponding to the alarm information sample set according to preset condition parameters; training an alarm suppression prediction model according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; extracting alarm information to be processed, performing alarm suppression prediction processing on the alarm information to be processed through the target alarm suppression prediction model to generate target suppression information; performing alarm suppression processing according to the target suppression information. In the big data monitoring scenario, the present application suppresses alarms in a timely manner to avoid the generation of alarm storms.

Description

Technical Field

[0001] The present application relates to the field of alarm monitoring technology, and in particular to an alarm storm suppression method, device, equipment and medium based on cluster information. Background Art

[0002] In the operation and maintenance scenario of monitoring digital services, the system needs to be able to automatically identify abnormal situations and issue alarms. For various parameter indicators detected by the monitoring system within a unit time, the system can trigger alarms on the premise of autonomously detecting abnormalities, so that the operation and maintenance personnel can deal with problems in a timely manner according to the alarm content. However, the monitoring system has the hidden danger of alarm storms, mainly because the monitored resource indicators are associated with each other and nested. Problems with sporadic resources in the cluster may trigger a series of resource associations / sub-resource operation abnormalities, thereby causing all related indicators to cause alarm storms due to collective abnormalities in real-time feedback values. In a unit minute, tens of thousands of alarm storms not only bring great difficulties to problem screening and processing, but also may cause the monitoring system to paralyze due to the sudden surge of too much data. Therefore, for big data monitoring scenarios, the monitoring system needs to collect indicator information of various computer system clusters in real time and issue targeted alarms. At the same time, effective measures are needed to ensure the monitoring of each monitored cluster and prevent the occurrence of alarm storms.

[0003] The existing measures to prevent alarm storms are to use multiple statically specified fixed rules, which cannot flexibly perform real-time model control on resource indicator groups based on clusters. In addition, if the cluster situation is judged and suppressed in real time through database mapping and formula calculation, in the big data monitoring scenario, the massive amount of data per unit time may be time-consuming and cannot meet real-time needs, making it difficult to suppress alarms in a timely manner. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose an alarm storm suppression method, device, equipment and medium based on cluster information, so as to suppress alarms in a timely manner in a big data monitoring scenario to avoid the generation of an alarm storm.

[0005] In order to solve the above technical problems, an embodiment of the present application provides an alarm storm suppression method based on cluster information, including:

[0006] Acquire parent-child cluster information and alarm information corresponding to the parent-child cluster information, and construct an alarm information sample set according to the parent-child cluster information and the alarm information;

[0007] Generate a suppression result sample set corresponding to the alarm information sample set according to preset condition parameters;

[0008] Training an alarm suppression prediction model according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model;

[0009] Extracting the alarm information to be processed, performing alarm suppression prediction processing on the alarm information to be processed by using the target alarm suppression prediction model, and generating target suppression information;

[0010] Perform alarm suppression processing according to the target suppression information.

[0011] In order to solve the above technical problems, an embodiment of the present application provides an alarm storm suppression device based on cluster information, including:

[0012] An alarm information sample set construction unit, used to obtain parent-child cluster information and alarm information corresponding to the parent-child cluster information, and to construct an alarm information sample set according to the parent-child cluster information and the alarm information;

[0013] A suppression result sample construction unit, used to generate a suppression result sample set corresponding to the alarm information sample set according to preset condition parameters;

[0014] An alarm suppression prediction model training unit is used to train the alarm suppression prediction model according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model;

[0015] A target suppression information generating unit, used for extracting the alarm information to be processed, performing alarm suppression prediction processing on the alarm information to be processed by the target alarm suppression prediction model, and generating target suppression information;

[0016] An alarm suppression processing unit is used to perform alarm suppression processing according to the target suppression information.

[0017] To solve the above technical problems, a technical solution adopted by the present invention is: to provide a computer device, including one or more processors; a memory for storing one or more programs, so that the one or more processors can implement any one of the above-mentioned alarm storm suppression methods based on cluster information.

[0018] To solve the above technical problems, a technical solution adopted by the present invention is: a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, any one of the above-mentioned alarm storm suppression methods based on cluster information is implemented.

[0019] The embodiment of the present invention provides a method, device, equipment and medium for suppressing an alarm storm based on cluster information. The method includes: obtaining parent-child cluster information and alarm information corresponding to the parent-child cluster information, constructing an alarm information sample set according to the parent-child cluster information and the alarm information; generating a suppression result sample set corresponding to the alarm information sample set according to preset condition parameters; training an alarm suppression prediction model according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; extracting alarm information to be processed, performing alarm suppression prediction processing on the alarm information to be processed through the target alarm suppression prediction model to generate target suppression information; performing alarm suppression processing according to the target suppression information. The embodiment of the present invention constructs an alarm information sample set and a suppression result sample set through the parent-child cluster relationship, cluster information and alarm information, and trains an alarm suppression prediction model to realize real-time alarm suppression prediction and suppression processing of alarm information, thereby realizing timely suppression processing of alarms in big data monitoring scenarios to avoid the generation of alarm storms. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 It is a flow chart of the implementation of the method process for suppressing an alarm storm based on cluster information provided in an embodiment of the present application;

[0022] Figure 2 This is a schematic diagram of an application environment of an alarm storm suppression method based on cluster information in one embodiment of the present invention;

[0023] Figure 3 It is a flowchart for implementing the first sub-process in the alarm storm suppression method based on cluster information provided in an embodiment of the present application;

[0024] Figure 4 It is a flowchart for implementing the second sub-process in the alarm storm suppression method based on cluster information provided in an embodiment of the present application;

[0025] Figure 5 It is a flowchart for implementing the third sub-process in the alarm storm suppression method based on cluster information provided in an embodiment of the present application;

[0026] Figure 6 It is a flowchart for implementing the fourth sub-process in the alarm storm suppression method based on cluster information provided in an embodiment of the present application;

[0027] Figure 7 It is a flowchart for implementing the fifth sub-process in the alarm storm suppression method based on cluster information provided in an embodiment of the present application;

[0028] Figure 8 It is a flowchart for implementing the sixth sub-process in the alarm storm suppression method based on cluster information provided in an embodiment of the present application;

[0029] Fig. 9 It is a schematic diagram of an alarm storm suppression device based on cluster information provided in an embodiment of the present application;

[0030] Fig.10 It is a schematic diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0032] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0033] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0034] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0035] It should be noted that the alarm storm suppression method based on cluster information provided in the embodiment of the present application is generally executed by a server, and accordingly, the alarm storm suppression device based on cluster information is generally configured in the server.

[0036] The embodiment of the present application performs real-time monitoring of resources such as hardware, virtual machines, and software for different users, and ensures the stability and efficient operation of resources through real-time feedback of parameter indicators of each resource dimension within a unit time. Therefore, a feature of the monitoring system is that it needs to receive and interpret a large amount of data streams in real time. Among them, when receiving monitoring data indicators in real time, it is necessary to analyze the operation of different resource services, and generate alarms in time when there are problems, so that the operation and maintenance personnel can deal with the problems of the resource system in time. Because the system resource indicators are nested with each other, sporadic anomalies may induce group anomalies and corresponding alarms. Alarm storm refers to the influx of a large number of alarms within a unit time, which may cause abnormal operation of the system, bring great difficulties to the operation and maintenance personnel to investigate and deal with, and affect the business. At the same time, the back-end system is flooded with massive interference information in real time, which may cause abnormal operation of the system. For this reason, the embodiment of the present application is intended to identify and intercept derivative alarms, avoid introducing a large number of alarms at the same time, and make it difficult to eliminate the cause of the alarm.

[0037] See also Figure 1 , Figure 1 A specific implementation of the alarm storm suppression method based on cluster information is shown.

[0038] The cluster information-based alarm storm suppression method provided by the embodiment of the present invention can be applied in the following aspects: Figure 2 In an application environment, the client communicates with the server through a network. The server can extract alarm information in real time, perform suppression prediction processing on the alarm information, generate target suppression information, and perform alarm suppression processing based on the target suppression information; the server sends the result of the alarm suppression processing to the client. At the same time, the client can send an alarm suppression instruction to the server so that the server performs alarm suppression processing according to the alarm suppression instruction. Further, the client can adjust the model parameters of the alarm suppression prediction model so that the model improves the accuracy of alarm suppression prediction. In the present invention, an alarm information sample set and a suppression result sample set are constructed through the parent-child cluster relationship, cluster information and alarm information, and the alarm suppression prediction model is trained to realize real-time alarm suppression prediction and suppression processing of the alarm information, so as to realize timely suppression processing of the alarm in the big data monitoring scenario to avoid the generation of alarm storms. Among them, the client can be but not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices. The server can be implemented by an independent server or a server cluster composed of multiple servers. The present invention is described in detail below through specific embodiments.

[0039] It should be noted that if there are substantially the same results, the method of the present invention is not limited to Figure 1 The process sequence shown is limited to the following steps:

[0040] S1: Obtain parent-child cluster information and alarm information corresponding to the parent-child cluster information, and construct an alarm information sample set according to the parent-child cluster information and the alarm information.

[0041] The embodiment of the present application is intended to build a basic level of alarm storm suppression that can be performed on clusters of different sizes and parent-child relationships in a timely manner according to the mapping relationship, that is, to avoid alarm storms from occurring in resource clusters of various size relationships.

[0042] Specifically, in the real-time monitoring scenario of a large number of resources, there are various resources and related monitored indicators that are bound in clusters. The embodiment of the present application needs to obtain parent-child cluster information and alarm information corresponding to the parent-child cluster information, and construct an alarm information sample set based on the parent-child cluster information and the alarm information. The parent-child cluster information includes cluster parent-child relationship and cluster size information.

[0043] See also Figure 3 , Figure 3 A specific implementation of step S1 is shown, which is described in detail as follows:

[0044] S11: recording the cluster parent-child relationship and the alarm information corresponding to the parent-child cluster information respectively through two columns of one-dimensional matrices of the same length.

[0045] S12: constructing the alarm information sample set according to the cluster parent-child relationship, the alarm information and the cluster size information.

[0046] Specifically, two single-dimensional matrices of the same length are used, one of which records the corresponding cluster parent-child relationship, and the other records the real-time alarm occurrence. Parent-child cluster relationships of different cluster sizes and corresponding alarm conditions are provided in a single alarm information sample as prediction features for the subsequent alarm suppression prediction model.

[0047] S2: Generate a suppression result sample set corresponding to the alarm information sample set according to preset condition parameters.

[0048] Specifically, the above steps have constructed an alarm information sample set. In the embodiment of the present application, each alarm information sample in the alarm information sample set generates a corresponding suppression result sample according to preset condition parameters, thereby obtaining a suppression result sample set. The preset condition parameters include cluster size range, sub-cluster alarm ratio that triggers interception, cluster processing method, and parent cluster case information triggering suppression and other parameters.

[0049] See also Figure 4 , Figure 4 A specific implementation of step S2 is shown, which is described in detail as follows:

[0050] S21: traverse each warning information sample in the warning information sample set in sequence.

[0051] S22: Compare the cluster size information in the alarm information sample with a preset threshold according to a preset cluster processing method to generate a first comparison result.

[0052] S23: Determine whether there is parent cluster alarm information in the alarm information sample, and obtain a determination result.

[0053] S24: Compare the sub-cluster alarm information in the alarm information sample with a preset ratio to generate a second comparison result.

[0054] S25: Generate suppression result samples corresponding to the warning information samples based on the first comparison result, the judgment result and the second comparison result, and obtain the suppression result sample set when the suppression result samples corresponding to all the warning information samples are generated.

[0055] Specifically, the preset cluster processing method is a processing method for the range of clusters that need to be suppressed, which includes flexible inclusion and cluster fixation. Among them, flexible inclusion means that clusters of a certain range of sizes can be suppressed (such as: resource indicator clusters of 8-20); cluster fixation means that only clusters of fixed size are judged. After the cluster processing method is determined, if any of the cluster size information in the alarm information sample is greater than the preset threshold, the parent cluster alarm information exists in the alarm information sample, and the child cluster alarm information in the alarm information sample is greater than the preset ratio, then a suppression result sample that needs to be suppressed is generated; if each item does not exist, then a suppression result sample that does not need to be suppressed is generated.

[0056] S3: training an alarm suppression prediction model according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model.

[0057] Specifically, training data and test data are constructed through the alarm information sample set and the suppression result sample set, and then the alarm suppression prediction model is trained and tested through the training data and the test data to obtain the target alarm suppression prediction model. In the application embodiment, the alarm suppression prediction model can be any one of a logistic regression algorithm model, a random forest algorithm model, a support vector machine (SVM) and a reinforcement learning algorithm.

[0058] See also Figure 5 , Figure 5 A specific implementation of step S3 is shown, which is described in detail as follows:

[0059] S31: constructing training data and test data according to the warning information sample set and the suppression result sample set.

[0060] Specifically, all warning information sample sets and suppression result sample sets are randomly shuffled to obtain shuffled samples, and the shuffled sample sets are divided into training data and test data according to a preset ratio, wherein the training data and the test data both include warning information samples and suppression result samples.

[0061] It should be noted that the preset ratio is set according to actual conditions and is not limited here. In a specific embodiment, the sample set consisting of the alarm information sample set and the suppression result sample set is divided into training data and test data according to a ratio of 8:2.

[0062] S32: Input the training data into the alarm suppression prediction model, and convert the training data into preset dimension data according to the type of the alarm suppression prediction model to obtain target training data.

[0063] Specifically, if the alarm suppression prediction model is any one of a logistic regression algorithm model, a random forest algorithm model, and a support vector machine (SVM), the training data is converted into two-dimensional data; if the alarm suppression prediction model is a reinforcement learning algorithm, the training data is converted into three-dimensional data.

[0064] S33: Performing model training on the alarm suppression prediction model using the target training data to obtain a trained alarm suppression prediction model.

[0065] See also Figure 6 , Figure 6 A specific implementation of step S34 is shown, which is described in detail as follows:

[0066] S341: extracting various types of indicator features from the target training data, and grouping the various types of indicator features to obtain grouping features.

[0067] S342: Perform classification mapping according to the grouping features to obtain a suppression result, and calculate prediction accuracy based on the suppression result and the suppression result samples in the target training data.

[0068] S343: If the prediction accuracy does not reach the preset threshold, the model parameters of the alarm suppression prediction model are adjusted, and the adjusted alarm suppression prediction model is iteratively trained again based on the training data until the prediction accuracy reaches the preset threshold, thereby obtaining the trained alarm suppression prediction model.

[0069] Specifically, during model training, it is necessary to extract various indicator features within each unit time, and then group the various indicator features to obtain group features. For example, cluster size, parent cluster alarm information, and child cluster alarm information can be extracted. Classification mapping is performed according to the grouping features to obtain the suppression result. The mapping results are respectively comparing the cluster size with the preset threshold, whether the parent cluster alarm information exists, and comparing the child cluster alarm information with the preset ratio. The prediction accuracy is calculated based on the suppression result and the suppression result sample in the target training data. If the prediction accuracy does not reach the preset threshold, the model parameters of the alarm suppression prediction model are adjusted, and the adjusted alarm suppression prediction model is iteratively trained based on the training data until the prediction accuracy reaches the preset threshold, and the trained alarm suppression prediction model is obtained.

[0070] S34: Testing and verifying the trained alarm suppression prediction model using the test data to obtain the target suppression prediction model.

[0071] Specifically, after the alarm suppression prediction model has been trained in the above steps, the trained alarm suppression prediction model is tested and verified by the test data. During the model test, the trained alarm suppression prediction model is used to predict the alarm information samples in the test data to obtain the alarm suppression prediction result, and then the prediction accuracy is calculated based on the alarm suppression samples in the test data and the alarm suppression prediction result, and the prediction accuracy is tested and verified to obtain the target suppression prediction model.

[0072] In a specific embodiment, the reinforcement learning algorithm model is used as the training model of the alarm suppression prediction model. The training data is input into the current environment in the reinforcement learning algorithm model, and the agent outputs the strategy based on the total reward threshold in the current environment, that is, the corresponding action is made according to the Q value of each action in the current environment, wherein the association between the state and the action can be calculated by the Q function, and the action is divided into those that need to be suppressed and those that do not need to be suppressed. Then, the reward and punishment parameters are generated according to the comparison between the execution result of the action and the suppression result sample in the training data; the parameters of the algorithm model are tuned based on the reward and punishment parameters by using the experience playback method, and then the training data is randomly sampled again to iteratively train the algorithm model until the target alarm suppression prediction model is obtained. And in the embodiment of the present application, the cluster alarm storm interception data manually triggered by the client is obtained, the cluster alarm storm interception data is converted into a three-dimensional feature set, and then the target alarm suppression prediction model is continuously model tuned by the three-dimensional feature set. In a specific embodiment, by respectively training the alarm suppression prediction model of the multilayer perceptron, the one-dimensional convolutional neural network, the two-dimensional convolutional neural network and the self-adjusting feature classification structure model, the evaluation accuracy corresponding to the above-mentioned each model is obtained to be 99%, 100%, 100% and 99% respectively, so that the cluster alarm information can be accurately suppressed and predicted through the embodiment of the present application.

[0073] S4: extracting the alarm information to be processed, performing alarm suppression prediction processing on the alarm information to be processed through the target alarm suppression prediction model, and generating target suppression information.

[0074] Specifically, after training and generating the target alarm suppression prediction model, the target alarm suppression prediction model is deployed in the alarm monitoring system. In the actual alarm monitoring scenario, the alarm information to be processed is extracted, and the target alarm suppression prediction model is used to perform alarm suppression prediction processing on the alarm information to be processed to generate target suppression information. The target suppression information is whether alarm suppression interception is required or not.

[0075] See also Figure 7 , Figure 7 A specific implementation of step S4 is shown, which is described in detail as follows:

[0076] S41: extracting the to-be-processed alarm information of a preset unit time from the alarm database in real time.

[0077] Specifically, the alarm information to be processed within a preset unit time is extracted from the alarm database in real time. For example, the alarm information may be extracted once every minute, and the alarm information is the alarm data within this minute.

[0078] S42: Cluster the alarm information to be processed and confirm the parent-child relationship information to obtain target alarm information.

[0079] See also Figure 8 , Figure 8 A specific implementation of step S42 is shown, which is described in detail as follows:

[0080] S421: Cluster the to-be-processed alarm information according to the connection relationship parameter column information in the alarm database to obtain target cluster alarm information.

[0081] S422: Compare each target cluster alarm information with a database table to determine the parent-child relationship information between the calibration indicators in the alarm information to be processed, and obtain the target alarm information.

[0082] Specifically, since the alarm information to be processed is stored in different connection relationship parameter columns with the alarm database, the alarm information to be processed is clustered according to the connection relationship parameter column information in the alarm database to obtain the target cluster alarm information. Then, for each target cluster alarm information, the corresponding database table is queried to determine the parent-child relationship information between the calibration indicators in the alarm information to be processed, and the target alarm information is obtained.

[0083] S43: Performing alarm suppression prediction processing on the target alarm information through the target alarm suppression prediction model to generate the target suppression information.

[0084] Specifically, the target warning information is input into the target warning suppression prediction model to perform suppression prediction processing on the target warning information to obtain the target suppression information.

[0085] S5: Perform alarm suppression processing according to the target suppression information.

[0086] Specifically, according to the target suppression information, the alarms that need to be suppressed are suppressed to avoid a large number of alarms being integrated into the alarm monitoring system at the same time, which makes it difficult to eliminate the causes of the alarms and cannot process the alarm information in time.

[0087] Furthermore, historical data after alarm suppression processing is obtained to obtain suppression processing data, and model parameters of the target alarm suppression prediction model are adjusted through the suppression processing data to achieve continuous updating of the model and improve the accuracy of alarm suppression prediction.

[0088] In an embodiment of the present application, parent-child cluster information and alarm information corresponding to the parent-child cluster information are obtained, and an alarm information sample set is constructed according to the parent-child cluster information and the alarm information; a suppression result sample set corresponding to the alarm information sample set is generated according to preset condition parameters; an alarm suppression prediction model is trained according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; unprocessed alarm information is extracted, and alarm suppression prediction processing is performed on the unprocessed alarm information through the target alarm suppression prediction model to generate target suppression information; alarm suppression processing is performed according to the target suppression information. The embodiment of the present invention constructs an alarm information sample set and a suppression result sample set through the parent-child cluster relationship, cluster information and alarm information, and trains an alarm suppression prediction model to realize real-time alarm suppression prediction and suppression processing of alarm information, thereby realizing timely suppression processing of alarms in big data monitoring scenarios to avoid alarm storms.

[0089] The embodiment of the present application can flexibly and timely control the resource alarm volume of each cluster within a dynamic balance per unit time for different cluster sizes and parent-child relationships, and fundamentally prevent the generation of alarm storms by real-time simulation of clusters in different situations. The embodiment of the present application can efficiently intercept and suppress monitored alarm indicators of different sizes and different parent-child relationships.

[0090] Please refer to Fig. 9 , as a response to the above Figure 1 The present application provides an embodiment of an alarm storm suppression device based on cluster information. Figure 1 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0091] like Fig. 9 As shown, the alarm storm suppression device based on cluster information of this embodiment includes: an alarm information sample set construction unit 61, a suppression result sample construction unit 62, an alarm suppression prediction model training unit 63, a target suppression information generation unit 64 and an alarm suppression processing unit 65, wherein:

[0092] The alarm information sample set construction unit 61 is used to obtain parent-child cluster information and alarm information corresponding to the parent-child cluster information, and to construct an alarm information sample set according to the parent-child cluster information and the alarm information;

[0093] A suppression result sample construction unit 62, configured to generate a suppression result sample set corresponding to the alarm information sample set according to preset condition parameters;

[0094] An alarm suppression prediction model training unit 63 is used to train the alarm suppression prediction model according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model;

[0095] The target suppression information generating unit 64 is used to extract the warning information to be processed, perform warning suppression prediction processing on the warning information to be processed through the target warning suppression prediction model, and generate target suppression information;

[0096] The alarm suppression processing unit 65 is used to perform alarm suppression processing according to the target suppression information.

[0097] Furthermore, the parent-child cluster information includes cluster parent-child relationship and cluster size information; the alarm information sample set construction unit 61 includes:

[0098] An alarm information acquisition unit, used to record the cluster parent-child relationship and the alarm information corresponding to the parent-child cluster information respectively through two columns of one-dimensional matrices of the same length;

[0099] The alarm information sample set construction unit is used to construct the alarm information sample set according to the cluster parent-child relationship, the alarm information and the cluster size information.

[0100] Furthermore, the suppression result sample construction unit 62 includes:

[0101] A sample traversal unit, used to traverse each alarm information sample in the alarm information sample set in sequence;

[0102] A first comparison unit, configured to compare the cluster size information in the alarm information sample with a preset threshold value according to a preset cluster processing method, and generate a first comparison result;

[0103] A judgment unit, used to judge whether there is parent cluster alarm information in the alarm information sample, and obtain a judgment result;

[0104] A second comparison unit, configured to compare the sub-cluster alarm information in the alarm information sample with a preset ratio to generate a second comparison result;

[0105] A suppression result sample generating unit is used to generate a suppression result sample corresponding to the warning information sample based on the first comparison result, the judgment result and the second comparison result, and when the suppression result samples corresponding to all the warning information samples are generated, the suppression result sample set is obtained.

[0106] Furthermore, the alarm suppression prediction model training unit 63 includes:

[0107] A training data construction unit, used to construct training data and test data according to the warning information sample set and the suppression result sample set;

[0108] A dimension conversion unit, used for inputting the training data into the alarm suppression prediction model, and converting the training data into preset dimension data according to the type of the alarm suppression prediction model to obtain target training data;

[0109] A model training unit, used to perform model training on the alarm suppression prediction model using the target training data to obtain a trained alarm suppression prediction model;

[0110] A model testing unit is used to test and verify the trained alarm suppression prediction model through the test data to obtain the target suppression prediction model.

[0111] Furthermore, the model testing unit includes:

[0112] A feature grouping unit is used to extract various indicator features in the target training data, and perform feature grouping on each of the indicator features to obtain grouping features;

[0113] A prediction accuracy calculation unit, configured to perform classification mapping according to the grouping features to obtain a suppression result, and calculate the prediction accuracy based on the suppression result and a suppression result sample in the target training data;

[0114] The training completion unit is used to adjust the model parameters of the alarm suppression prediction model if the prediction accuracy does not reach a preset threshold, and re-iterate the adjusted alarm suppression prediction model based on the training data until the prediction accuracy reaches the preset threshold, thereby obtaining the trained alarm suppression prediction model.

[0115] Further, the target suppression information generating unit 64 includes:

[0116] The unit for extracting the alarm information to be processed is used to extract the alarm information to be processed in a preset unit time from the alarm database in real time;

[0117] A target alarm information generating unit, used for clustering the alarm information to be processed and confirming the parent-child relationship information to obtain target alarm information;

[0118] The target suppression information generating unit is used to perform alarm suppression prediction processing on the target alarm information through the target alarm suppression prediction model to generate the target suppression information.

[0119] Furthermore, the target warning information generating unit includes:

[0120] A target cluster generating unit, configured to cluster the to-be-processed alarm information according to the connection relationship parameter column information in the alarm database to obtain target cluster alarm information;

[0121] The parent-child relationship confirmation unit is used to compare each target cluster alarm information with the database table to determine the parent-child relationship information between the calibration indicators in the alarm information to be processed, and obtain the target alarm information.

[0122] In an embodiment of the present application, parent-child cluster information and alarm information corresponding to the parent-child cluster information are obtained, and an alarm information sample set is constructed according to the parent-child cluster information and the alarm information; a suppression result sample set corresponding to the alarm information sample set is generated according to preset condition parameters; an alarm suppression prediction model is trained according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; unprocessed alarm information is extracted, and alarm suppression prediction processing is performed on the unprocessed alarm information through the target alarm suppression prediction model to generate target suppression information; alarm suppression processing is performed according to the target suppression information. The embodiment of the present invention constructs an alarm information sample set and a suppression result sample set through the parent-child cluster relationship, cluster information and alarm information, and trains an alarm suppression prediction model to realize real-time alarm suppression prediction and suppression processing of alarm information, thereby realizing timely suppression processing of alarms in big data monitoring scenarios to avoid alarm storms.

[0123] To solve the above technical problems, the present application also provides a computer device. Fig.10 , Fig.10 This is a basic structural block diagram of the computer device in this embodiment.

[0124] The computer device 7 includes a memory 71, a processor 72, and a network interface 73 which are interconnected and communicated with each other through a system bus. It should be noted that: Fig.10 Only a computer device 7 having three components, a memory 71, a processor 72, and a network interface 73, is shown in the figure, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital processors (DSPs), embedded devices, etc.

[0125] Computer devices can be computing devices such as desktop computers, notebooks, PDAs, and cloud servers. Computer devices can interact with users through keyboards, mice, remote controls, touch pads, or voice control devices.

[0126] The memory 71 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 71 can be an internal storage unit of the computer device 7, such as a hard disk or memory of the computer device 7. In other embodiments, the memory 71 can also be an external storage device of the computer device 7, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 7. Of course, the memory 71 can also include both the internal storage unit of the computer device 7 and its external storage device. In this embodiment, the memory 71 is generally used to store the operating system and various application software installed on the computer device 7, such as the program code of the alarm storm suppression method based on cluster information, etc. In addition, the memory 71 can also be used to temporarily store various types of data that have been output or are to be output.

[0127] The processor 72 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 72 is generally used to control the overall operation of the computer device 7. In this embodiment, the processor 72 is used to run the program code stored in the memory 71 or process data, such as running the program code of the alarm storm suppression method based on cluster information to implement various embodiments of the alarm storm suppression method based on cluster information.

[0128] The network interface 73 may include a wireless network interface or a wired network interface, and the network interface 73 is generally used to establish a communication connection between the computer device 7 and other electronic devices.

[0129] The present application also provides another implementation, namely, providing a computer-readable storage medium, which stores a computer program, and the computer program can be executed by at least one processor to enable the at least one processor to perform the steps of the above-mentioned alarm storm suppression method based on cluster information.

[0130] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0131] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to replace some of the technical features therein with equivalents. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A method for suppressing an alarm storm based on cluster information, characterized in that: include: Acquire parent-child cluster information and alarm information corresponding to the parent-child cluster information, and construct an alarm information sample set according to the parent-child cluster information and the alarm information; Generate a suppression result sample set corresponding to the alarm information sample set according to preset condition parameters; Training an alarm suppression prediction model according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; Extracting the alarm information to be processed, performing alarm suppression prediction processing on the alarm information to be processed by using the target alarm suppression prediction model, and generating target suppression information; Perform alarm suppression processing according to the target suppression information.

2. The method for suppressing an alarm storm based on cluster information according to claim 1, characterized in that: The parent-child cluster information includes cluster parent-child relationship and cluster size information; the acquiring of the parent-child cluster information and the alarm information corresponding to the parent-child cluster information, and constructing an alarm information sample set according to the parent-child cluster information and the alarm information, includes: The parent-child relationship of the cluster and the alarm information corresponding to the parent-child cluster information are recorded respectively by two single-dimensional matrices of the same length; The alarm information sample set is constructed according to the cluster parent-child relationship, the alarm information and the cluster size information.

3. The method for suppressing an alarm storm based on cluster information according to claim 2, characterized in that: The generating, according to the preset condition parameters, a suppression result sample set corresponding to the alarm information sample set comprises: Traversing each warning information sample in the warning information sample set in turn; Comparing the cluster size information in the alarm information sample with a preset threshold according to a preset cluster processing method to generate a first comparison result; Determine whether there is parent cluster alarm information in the alarm information sample, and obtain a determination result; Comparing the sub-cluster alarm information in the alarm information sample with a preset ratio to generate a second comparison result; The suppression result samples corresponding to the warning information samples are generated based on the first comparison result, the judgment result and the second comparison result. When the suppression result samples corresponding to all the warning information samples are generated, the suppression result sample set is obtained.

4. The method for suppressing an alarm storm based on cluster information according to claim 1, characterized in that: The step of training the alarm suppression prediction model according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model includes: Constructing training data and test data according to the warning information sample set and the suppression result sample set; Inputting the training data into the alarm suppression prediction model, and converting the training data into preset dimension data according to the type of the alarm suppression prediction model to obtain target training data; Performing model training on the alarm suppression prediction model using the target training data to obtain a trained alarm suppression prediction model; The trained alarm suppression prediction model is tested and verified by using the test data to obtain the target suppression prediction model.

5. The method for suppressing an alarm storm based on cluster information according to claim 4, characterized in that: The step of performing model training on the alarm suppression prediction model by using the target training data to obtain a trained alarm suppression prediction model includes: Extracting various indicator features from the target training data, and grouping the various indicator features to obtain grouping features; Performing classification mapping according to the grouping features to obtain an inhibition result, and calculating a prediction accuracy based on the inhibition result and an inhibition result sample in the target training data; If the prediction accuracy does not reach the preset threshold, the model parameters of the alarm suppression prediction model are adjusted, and the adjusted alarm suppression prediction model is iteratively trained again based on the training data until the prediction accuracy reaches the preset threshold, thereby obtaining the trained alarm suppression prediction model.

6. The method for suppressing an alarm storm based on cluster information according to any one of claims 1 to 5, characterized in that: The extracting the to-be-processed alarm information, performing alarm suppression prediction processing on the to-be-processed alarm information through the target alarm suppression prediction model, and generating target suppression information includes: Extracting the to-be-processed alarm information of a preset unit time from the alarm database in real time; The to-be-processed alarm information is grouped into clusters and the parent-child relationship information is confirmed to obtain target alarm information; The target alarm suppression prediction model is used to perform alarm suppression prediction processing on the target alarm information to generate the target suppression information.

7. The method for suppressing an alarm storm based on cluster information according to claim 6, characterized in that: The step of grouping the alarm information to be processed into clusters and confirming the parent-child relationship information to obtain target alarm information includes: Clustering the to-be-processed alarm information according to the connection relationship parameter column information in the alarm database to obtain target cluster alarm information; Each target cluster alarm information is compared with a database table to determine the parent-child relationship information between the calibration indicators in the alarm information to be processed, and obtain the target alarm information.

8. An alarm storm suppression device based on cluster information, characterized in that: include: An alarm information sample set construction unit, used to obtain parent-child cluster information and alarm information corresponding to the parent-child cluster information, and to construct an alarm information sample set according to the parent-child cluster information and the alarm information; A suppression result sample construction unit, used to generate a suppression result sample set corresponding to the alarm information sample set according to preset condition parameters; An alarm suppression prediction model training unit is used to train the alarm suppression prediction model according to the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; A target suppression information generating unit, used for extracting the alarm information to be processed, performing alarm suppression prediction processing on the alarm information to be processed by the target alarm suppression prediction model, and generating target suppression information; An alarm suppression processing unit is used to perform alarm suppression processing according to the target suppression information.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the method for suppressing an alarm storm based on cluster information according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the alarm storm suppression method based on cluster information according to any one of claims 1 to 7 is implemented.

Images