Method and system for handling risky networks with hierarchical positioning

Abstract

The present application relates to a risk network handling method and system with hierarchical positioning, which receives input data from devices in a data source and determines the risk data in the input data. This can intelligently analyze existing risk data and link risk data, reduce useless risks, and improve the quality of risk. It also supports intelligent association of relevant indicators and calling of link data when warning. At the same time, it improves the fault classification and grading, risk handling process and other mechanisms. The risk data is compressed and merged into risk reporting events. The time correlation of risk reports is analyzed based on the ACorFrepm algorithm. This can generate a judgment result for the risk reporting event. After the root cause analysis formulates a solution, a change process can be initiated until the problem is completely resolved. Based on the handling results of the hierarchical risk reporting events and the causes of the hierarchical risk reporting events, archived knowledge of risk reporting events is formed. Archived knowledge can effectively control problem events.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a hierarchical and localized risk network disposal method and system. Background Art

[0002] The network management of computer cluster networks and Internet of Things networks mostly has multiple levels, and each level contains a large number of network usage nodes, monitoring nodes, and primary management nodes. The traditional network risk handling method is that the monitoring node monitors the threshold, the monitoring node generates risks and third-party risks, and pushes them to the risk warning platform through the API interface. After preliminary preprocessing, the risk report is formed after deduplication based on rules or algorithm noise reduction. Multiple related risk reports are finally generated through the association link. This leads to the imperfect risk problem handling mechanism of the traditional network risk handling method. The imperfect risk problem handling mechanism is mainly reflected in the inability of the traditional network risk handling method to effectively control problem events and the difficulty in locating the problem node after receiving the risk. To this end, it is necessary to propose a hierarchical positioning risk network disposal method and system to address the defects of the imperfect risk problem handling mechanism of the traditional network risk handling method. Summary of the invention

[0003] Based on this, it is necessary to propose a hierarchical and positioned risk network disposal method and system to address the defects of the traditional network risk management method in the risk problem handling mechanism.

[0004] The present application provides a hierarchical and localized risk network disposal method, including:

[0005] receiving input data from a device in a data source;

[0006] Based on the screening of risk sources, determine the risk data in the input data;

[0007] Compress the risk reporting data to form risk report compression;

[0008] Using the merging rules of risk reporting data, the risk reports are compressed and merged into risk reporting events;

[0009] Determine the dangerous events and generate the determination results;

[0010] Based on the determination results of the dangerous events, the dangerous events are classified;

[0011] Handle classified risk reports according to handling rules;

[0012] Register the graded risk reports and locate the causes of the graded risk reports;

[0013] Based on the handling results of the graded dangerous alarm events and the causes of the graded dangerous alarm events, archived knowledge of dangerous alarm events is formed.

[0014] The present application provides a hierarchical and localized risk network management system, including:

[0015] A server, used to execute the risk network handling method of hierarchical positioning;

[0016] The memory is communicatively connected with the server.

[0017] The present application relates to a hierarchical positioning risk network disposal method and system, which receives input data of a device in a data source and determines the risk data in the input data. This can intelligently analyze existing risk data and link risk data, reduce useless risks, and improve the quality of risk. It also supports intelligent association of relevant indicators and call link data when reporting risks. At the same time, it improves the fault classification and classification, risk processing process and other mechanisms. The risk data is compressed and merged into risk reporting events. The time correlation of risk reports is analyzed based on the ACorFrepm algorithm. The risk reports are abstracted into indicator data, and the co-occurrence is counted using a sliding time window to mine the time correlation of the risk reports, and the dynamic correlation degree between faults is output to generate the judgment result of the risk reporting event. After the risk reporting event is formed, it is first pushed to the event process automatically, and after the first and second lines are handled, the event will be automatically closed according to the process status after the problem is handled. If it is a common problem, it can be upgraded to a problem process. After the root cause analysis formulates a solution, a change process can be initiated, and finally until the problem is completely solved. Based on the disposal results of the hierarchical risk reporting events and the causes of the hierarchical risk reporting events, the archived knowledge of the risk reporting events is formed. Archiving knowledge can effectively manage problem events. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A method flow chart of a hierarchical and localized risk network handling method provided in an embodiment of the present application;

[0019] Figure 2 A structural connection diagram of a hierarchical and localized risk network handling system provided in one embodiment of the present application.

[0020] Reference numerals:

[0021] 100-server; 200-storage. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0023] The present application provides a hierarchical and localized risk network disposal method.

[0024] like Figure 1 As shown, in one embodiment of the present application, a hierarchical and localized risk network handling method includes:

[0025] S100, receiving input data from a device in a data source.

[0026] Specifically, the data sources mainly include equipment monitoring data of terminals, relay equipment and other equipment, data of scheduling equipment, and data of monitoring equipment.

[0027] S200, based on the screening of risk sources, determining risk data in the input data.

[0028] Specifically, the risk source can be filtered using keywords, rule status started, stopped, filtering conditions, risk sources, filtering fields, etc. The risk source includes the risk source type, the filtering conditions include the label, and the filtering fields include the field name and the merge rule name. These filtering methods can filter out the risk data in the input data.

[0029] S300, compressing the risk reporting data to form a compressed risk report.

[0030] Specifically, risk report compression can refer to parameters such as the integration interface component name, integration scenario number, initiator, initiator data format, receiver, receiver data format, exchange data entity name and time window.

[0031] It is worth mentioning that multiple different risk reporting data can be compressed into one risk reporting event.

[0032] Different risk reporting events may include the same risk reporting data.

[0033] This can enhance the linkage of topological analysis of risk reporting events. This is conducive to improving the positioning capability of the problem node after receiving the risk report and enhancing the effectiveness of effective management and control of problem events.

[0034] S400, using the merging rule of the risk report data, compressing and merging the risk reports into risk report events.

[0035] Specifically, compressing the risk data into risk reporting events is determined by the actual data processing size of the customer environment. In general, the GateWay gateway service is usually deployed in advance in conjunction with other company components. Nacos dynamic service configuration is also used by other company components, so it belongs to the overall cluster configuration deployment. Zk and Kafka are also used in other company components, so they will also be deployed in advance. User center, DOSM and other services will also be deployed in advance. Now we deploy three servers as the standard. First, we need to deploy three event centers, three RedXA clusters, and three ES clusters.

[0036] S500, determining the danger alarm event and generating a determination result.

[0037] Specifically, intelligent analysis is performed on existing danger warning data and link danger warning data to reduce useless danger warnings and improve the quality of danger warnings. It also supports intelligent association of relevant indicators and call of link data when warning. At the same time, it improves the fault classification and grading, danger handling process and other mechanisms.

[0038] S600: Classify the dangerous events based on the determination result of the dangerous events.

[0039] Specifically, the alarm messages of the monitoring system are managed in a unified platform. The alarm source supports multiple alarm source access methods such as REST API, URL callback, and third-party alarm sources.

[0040] Then, the fields and content of the original risk are modified to make the risk have unified fields, which is convenient for sorting, searching, and displaying on the display interface. At the same time, it is convenient for the subsequent process of generating events, and the fields of risk information from different data sources are unified to facilitate the setting of associations. Using additional data, the risk message is given richer information, such as host, service and other information, and the resource information maintained in the CMDB is obtained and associated with the risk message.

[0041] Based on intelligent algorithms, massive and continuous redundant messages are compressed and merged to suppress the number of danger messages, reduce the frequency of danger messages, reduce the interference of redundant danger messages on operation and maintenance work, and improve the efficiency of operation and maintenance work.

[0042] It uses machine learning algorithms to identify problems in applications, services, middleware, databases, and infrastructure that cause most of today's incidents and outages, recommend possible causes of failures, and help operations personnel identify the root causes of incidents and outages in real time.

[0043] S700: Handle the graded danger alarm event according to the handling rules.

[0044] S800: register the graded risk alert events and locate the causes of the graded risk alert events.

[0045] S900, based on the handling results of the graded risk alert events and the causes of the graded risk alert events, archived knowledge of the risk alert events is formed.

[0046] This embodiment relates to a hierarchical positioning risk network handling method, which receives input data of a device in a data source and determines the risk data in the input data. This can intelligently analyze existing risk data and link risk data, reduce useless risk reports, and improve the quality of risk reports. It also supports intelligent association of relevant indicators and call link data when reporting risks. At the same time, it improves the fault classification and grading, risk processing process and other mechanisms. The risk data is compressed and merged into risk reporting events. The time correlation of risk reports is analyzed based on the ACorFrepm algorithm. The risk reports are abstracted into indicator data, and the co-occurrence thereof is counted using a sliding time window, so as to mine the time correlation of risk reports, and the dynamic correlation degree between faults is output to generate the judgment result of the risk reporting event. After the risk reporting event is formed, it is first pushed to the event process automatically, and after the first and second lines are handled, the event will be automatically closed according to the process status after the problem is handled. If it is a common problem, it can be upgraded to a problem process. After the root cause analysis formulates a solution, a change process can be initiated, and finally until the problem is completely solved. Based on the handling results of the hierarchical risk reporting events and the causes of the hierarchical risk reporting events, the archived knowledge of the risk reporting events is formed. Archiving knowledge can effectively manage problem events.

[0047] In one embodiment of the present application, S100 includes:

[0048] S110, defining a data source including a World Wide Web component, a control node component, a service node component, a keyword component and a client component.

[0049] Specifically, the client component is used to connect to the client, obtain the user's request, and receive the client's incoming instructions. In the risk reporting event, there is a network risk that is a client-side network risk or a network risk disguised as a client-side network risk, such as a DDOS attack.

[0050] The World Wide Web component is used to accept requests from the web layer and encapsulate data processing logic.

[0051] The service node component is used for business logic processing.

[0052] The control node component is the communication and handling of dangerous events for the secondary event center and the server's own event center.

[0053] The keyword component operates based on basic data and can call storage.

[0054] S120, establishing communication between the world wide web component and the client component, so that the world wide web component receives input data from a device in the client component.

[0055] Specifically, service calls are used to communicate between the World Wide Web component and the client component, and the http protocol is used between layers.

[0056] S130, establishing communication between the control node component and the world wide web component, so that the control node component receives input data from a device in the world wide web component.

[0057] S140, establishing communication between the service node component itself and the control node component to receive input data of the device summarized by the control node component.

[0058] Specifically, the input data of the device in the client component, the input data of the device in the World Wide Web component, and the input data of the device in the control node component all have the identity of the service node component.

[0059] More specifically, the World Wide Web component receives data from the client component, which is pushed to the service node component through the API interface or Kafka. The control node component filters data based on the keyword component, and the control node component transmits the filtered data to the service node component. After preliminary preprocessing, the data is deduplicated based on rules or algorithms to form a risk report. Multiple related risk reports are linked together to eventually generate an event.

[0060] After an incident is formed, it will be automatically pushed to the event process. After being handled by the first and second lines, the incident will be automatically closed according to the process status after the problem is resolved. If it is a common problem, it can be upgraded to a problem process. After the root cause analysis and solution are formulated, the change process can be initiated until the problem is completely resolved.

[0061] In one embodiment of the present application, S100 further includes:

[0062] S151, establish a keyword component.

[0063] Specifically, the keyword components include the field name of the risk source, the recommended level of the risk source, and the risk source source anchoring program.

[0064] The field name of the risk source is used to filter the risk source in the input data.

[0065] The recommended level of risk sources is used to determine the initial risk level of risk sources.

[0066] The alarm source anchoring procedure is used to determine the device address of the alarm source.

[0067] S152, incorporate the World Wide Web interface program into the keyword component.

[0068] Specifically, the World Wide Web interface program unifies the alarm messages of the monitoring system into one platform for management. The alarm source supports multiple alarm source access methods such as REST API, URL callback, and third-party alarm sources.

[0069] S153, incorporating the distributed interface program into the keyword component.

[0070] S154, sorting the input data of the receiving device based on the field conversion script of the keyword component.

[0071] S155, obtaining data source input data in a format that matches the format.

[0072] S156, parsing the source of the data source input data.

[0073] S157, generate the input data of preliminary screening and the device address of the source anchor.

[0074] Specifically, the source-anchored device address has a one-to-one mapping with the initially screened input data.

[0075] Based on the analysis of the current health status of the system through the preliminary screening of input data and the source anchored device address, the priority of handling the warning is determined dynamically. The cycle characteristics, impact range, processing time, severity and other information of the corresponding fault are obtained from the same fault, the same problem warning, the associated indicators and the associated topology, and finally the warning level is determined through machine learning and sorting models.

[0076] In one embodiment of the present application, S200 includes:

[0077] S210, receiving preliminarily screened input data.

[0078] S220, using keyword component field detection to determine risk data.

[0079] S230, determining the source anchored device address of the risk data based on the mapping between the source anchored device address and the preliminarily screened input data.

[0080] Specifically, the risk data can be determined by detecting the keyword component field of the initially screened input data. Each of the initially screened input data corresponds to a source anchored device address.

[0081] When a piece of input data that has been initially screened is determined to be risky data, the risky data will be mapped to the source anchored device address corresponding to the initially screened input data.

[0082] In one embodiment of the present application, S500 includes:

[0083] S510, selecting a risk data.

[0084] S520: Based on the risk value detected by the field of the risk data, it is determined whether the risk value of the selected risk data is less than the risk threshold of the risk storm.

[0085] S530: If the risk value of the selected dangerous data is less than the risk threshold of the dangerous storm, it is determined that the dangerous data is not a source of the dangerous storm.

[0086] S540: If the risk value of the selected dangerous data is greater than or equal to the risk threshold of the dangerous storm, it is determined that the dangerous data is a source of the dangerous storm.

[0087] Specifically, more fault information is obtained from the inside and outside of the danger, forming a normalized danger message. The real-time danger message is aggregated into time series data, and the data is stabilized from the perspective of energy by combining difference and sliding average. The bilateral energy of the storm point is calculated to achieve real-time detection of the danger storm.

[0088] An alert storm consists of multiple near miss events.

[0089] In one embodiment of the present application, S600 includes:

[0090] S611, receiving danger data from a source that does not belong to the danger storm.

[0091] S612, select a risk data.

[0092] S613, based on the frequency characteristics of the danger data, determining that the selected danger data is the same-fault danger data.

[0093] S614, if the selected danger data is the same fault danger data, then call the mapping between the source anchored device address and the preliminarily screened input data, determine the source anchored device address of the danger data, and the risk level of the danger data is level 2, and return to the selection of a danger data until all danger data are selected.

[0094] S615: If the selected danger data is not the same-fault danger data, determine that the selected danger data is the same-problem danger data.

[0095] S616, if the selected danger data is not the danger data with the same problem, then execute the associated topology program for the problem of the danger data, and return to the selection of a danger data until all the danger data are selected; the associated topology program is used to reduce the probability of danger storm.

[0096] S617, if the selected risk data is risk data with the same problem, then based on the problem rule of the associated topology program, determine the spatial characteristics of the problem in the risk data, and return to the selection of a risk data until all the risk data are selected.

[0097] S621, receiving danger data belonging to the source of the danger storm.

[0098] S622, select a risk data.

[0099] S623, performing time domain characteristics on the selected risk data; the time domain characteristics include historical time domain characteristics and real-time time domain characteristics.

[0100] S624, determining whether the selected risk warning data has historical time domain characteristics.

[0101] S625, if the selected danger data does not have the historical time domain characteristics, it is determined that the selected danger data has the real-time time domain characteristics, and the risk level of the selected danger data is determined to be level one, and the risk level of the danger storm is determined to be level one.

[0102] S626: If the selected risk data has historical time domain characteristics, determine whether the selected risk data has real-time time domain characteristics.

[0103] S627: If the selected danger data does not have a real-time time domain characteristic, determine that the risk level of the selected danger data is level 2 and the risk level of the danger storm is level 2.

[0104] S628, if the selected danger data has real-time time domain characteristics, frequency analysis and spatial analysis are performed on the danger storm to determine that the risk level of the selected danger data is level one and the risk level of the danger storm is level two.

[0105] Specifically, the time correlation of alarms is analyzed based on the ACorFrepm algorithm. Alarms are abstracted into indicator data, and the co-occurrence of alarms is counted using a sliding time window to mine the time correlation of alarms and output the dynamic correlation degree between faults.

[0106] More specifically, the risk data will be directed to the risk database, indicator database, and topology database. The risk data will be directed to determine the real-time time domain characteristics. It can also be directed to the original level judgment, which is actually the historical time domain characteristic judgment.

[0107] The risk database is mainly used to distinguish between fault alarms and problem alarms. The risk database can determine the frequency characteristics of risk data.

[0108] The indicator library is mainly used to determine the correlation indicators of the danger data in the danger storm. The indicator library can determine the time domain characteristics of the danger data.

[0109] The topology library is used to determine the topological relationship of device addresses anchored by different sources in the danger storm. The topology library can determine the spatial characteristics of danger data.

[0110] The risk level of warning data and the risk level of warning storm can be judged based on frequency characteristics, time domain characteristics, spatial characteristics and original levels.

[0111] In one embodiment of the present application, S800 includes:

[0112] S810, select a danger alarm event.

[0113] S820, determining all risk reporting data in the selected risk reporting event.

[0114] S830, counting the number of high-risk items in the risk data whose risk level is level 1.

[0115] S840, calculating the ratio of the number of high risks to the total amount of risk reporting data of the selected risk reporting event to obtain a risk threshold of the risk reporting event.

[0116] S850, determining whether the risk threshold of the selected dangerous alarm event is less than or equal to the acceptance threshold of the dangerous alarm event.

[0117] S860, if the risk threshold of the selected dangerous alarm event is less than or equal to the collection threshold of the dangerous alarm event, the selected dangerous alarm event is not included in the archived knowledge, and the process returns to selecting a dangerous alarm event until all dangerous alarm events are selected.

[0118] S870, if the risk threshold of the selected dangerous alarm event is greater than the collection threshold of the dangerous alarm event, the device address anchored by the source of the dangerous alarm data, the problem of the selected dangerous alarm event, and the fault of the selected dangerous alarm event are used as the cause of the dangerous alarm event, and the process of selecting a dangerous alarm event is returned until all dangerous alarm events are selected.

[0119] This embodiment relates to a method for registering graded risk alert events. The risk threshold of the risk alert event can be used as a risk alert event classification strategy. Each risk alert event has multiple topologies, and positioning classification can be achieved.

[0120] In one embodiment of the present application, S900 includes:

[0121] S910, select a danger alarm event.

[0122] S920, select a problem regarding a dangerous incident.

[0123] S930, using the time domain analysis in the time domain characteristic analysis, determine whether the problem of the selected dangerous event is a problem of a dangerous event in a real-time dangerous storm.

[0124] S940, if the problem of the selected dangerous alarm event is the problem of the dangerous alarm event in the real-time dangerous storm, then return to the judgment of the dangerous alarm event, generate a judgment result, and update the topological relationship of the dangerous alarm event until the problem of the selected dangerous alarm event is not the problem of the dangerous alarm event in the real-time dangerous storm.

[0125] S950: If the selected problem of the risk reporting event is not a problem of the risk reporting event in the real-time risk reporting storm, archived knowledge of the risk reporting event is formed.

[0126] S960, returning to the question of selecting a dangerous alarm event, until all the questions about dangerous alarm events are selected and completed.

[0127] S970, returning to the process of selecting a risk alert event until all risk alert events are selected.

[0128] Specifically, the handling results of the graded danger warning events will be fed back to the new danger storm. When there is no danger warning event in the real-time danger storm, it means that the storm handling is completed. When there is a danger warning event in the real-time danger storm, it means that the storm handling is not completed.

[0129] That is, if the problem of the selected danger report event is the problem of the danger report event in the real-time danger storm, then the judgment of the danger report event is returned, a judgment result is generated, and the topological relationship of the danger report event is updated. Re-updating the topological relationship of the danger report event can realize the re-processing of the danger report event.

[0130] The present application provides a hierarchical and localized risk network handling system.

[0131] like Figure 2 As shown, in one embodiment of the present application, a hierarchical and localized risk network handling system includes a server 100 and a storage 200 .

[0132] The server 100 is used to execute the risk network handling method with hierarchical positioning.

[0133] The storage 200 is communicatively connected with the server 100 .

[0134] This implementation involves a hierarchical positioning risk network handling system. The server 100 receives input data from the device in the data source and determines the risk data in the input data. This can intelligently analyze the risk data and link risk data in the memory 200, reduce useless risks, and improve the quality of risk. It also supports intelligent association of relevant indicators and calling link data when reporting risks. At the same time, it improves the fault classification and classification, risk handling process and other mechanisms. The risk data is compressed and merged into risk reporting events. The time correlation of risk reports is analyzed based on the ACorFrepm algorithm. The risk reports are abstracted into indicator data, and the co-occurrence is counted using a sliding time window to mine the time correlation of the risk reports, and the dynamic correlation degree between faults is output to generate the judgment result of the risk reporting event. After the risk reporting event is formed, it is first pushed to the event process automatically, and after the first and second lines are handled, the event will be automatically closed according to the process status after the problem is handled. If it is a common problem, it can be upgraded to a problem process. After the root cause analysis and solution are formulated, a change process can be initiated, and finally until the problem is completely solved. Based on the handling results and causes of graded risk reports, archived knowledge of risk reports is formed. Archived knowledge can effectively control problem events.

[0135] The technical features of the above-described embodiments may be arbitrarily combined, and the execution order of the method steps is not limited. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0136] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A hierarchical and localized risk network treatment method, characterized in that: include: receiving input data from a device in a data source; Based on the screening of risk sources, determine the risk data in the input data; Compress the risk reporting data to form risk report compression; Using the merging rules of risk reporting data, the risk reports are compressed and merged into risk reporting events; Determine the dangerous report event and generate the determination result; Based on the determination results of the dangerous events, the dangerous events are classified; Handle classified risk reports according to handling rules; Register the graded risk reports and locate the causes of the graded risk reports; Based on the handling results of the graded dangerous alarm events and the causes of the graded dangerous alarm events, archived knowledge of dangerous alarm events is formed.

2. The hierarchical and localized risk network handling method according to claim 1 is characterized in that: The receiving input data of a device in a data source includes: Defining data sources including World Wide Web components, control node components, service node components, keyword components and client components; establishing communication between the web component and the client component so that the web component receives input data from a device in the client component; Establishing communication between the control node component and the world wide web component so that the control node component receives input data from a device in the world wide web component; Establish communication between the service node component and the control node component to receive input data of the device summarized by the control node component; the input data of the device in the client component, the input data of the device in the World Wide Web component and the input data of the device in the control node component all have the identity of the service node component.

3. The hierarchical and localized risk network handling method according to claim 2 is characterized in that: The receiving input data of the device in the data source also includes: Establish keyword components; Incorporate World Wide Web interface programs into keyword components; Incorporate distributed interface procedures into keyword components; Field conversion scripts based on keyword components to organize input data from receiving devices; Obtaining data from a data source with a format that matches the input data; Parse the source of the data in the data source input; Generate preliminary screened input data and source-anchored device addresses; the source-anchored device addresses have a one-to-one mapping with the preliminary screened input data.

4. The hierarchical and localized risk network handling method according to claim 3 is characterized in that: The step of determining the risk data in the input data based on the screening of the risk source includes: receiving input data for preliminary screening; Use keyword component field detection to determine risk data; Based on the mapping of the source-anchored device address and the preliminarily screened input data, the source-anchored device address of the risk data is determined.

5. The hierarchical and localized risk network handling method according to claim 4 is characterized in that: The step of determining the risk event and generating a determination result includes: Select a risk data; Based on the risk value detected by the field of the risk data, it is determined whether the risk value of the selected risk data is less than the risk threshold of the risk storm; If the risk value of the selected risk data is less than the risk threshold of the risk storm, it is determined that the risk data is not the source of the risk storm; If the risk value of the selected dangerous data is greater than or equal to the risk threshold of the dangerous storm, it is determined that the dangerous data is the source of the dangerous storm.

6. The hierarchical and localized risk network handling method according to claim 5 is characterized in that: The step of grading the dangerous events based on the determination result of the dangerous events includes: Receiving distress data from sources other than the distress storm; Select a risk data; Based on the frequency characteristics of the danger data, determining that the selected danger data is the same fault danger data; If the selected danger data is the same fault danger data, the mapping between the source anchored device address and the initially screened input data is called to determine the source anchored device address of the danger data and the risk level of the danger data is level 2, and the method of selecting a danger data is returned until all danger data are selected; If the selected danger data is not the same fault danger data, then it is determined that the selected danger data is the same problem danger data; If the selected danger data is not the danger data with the same problem, the associated topology program is executed for the problem of the danger data, and the selection of a danger data is returned until all the danger data are selected; the associated topology program is used to reduce the probability of danger storm; If the selected risk data is the risk data with the same problem, the spatial characteristics of the problem in the risk data are determined based on the problem rule of the associated topology program, and the selection of a risk data is returned until all the risk data are selected.

7. The hierarchical and localized risk network handling method according to claim 6 is characterized in that: The step of grading the dangerous events based on the determination result of the dangerous events also includes: Receiving distress data belonging to a source of a distress storm; Select a risk data; Perform time domain characteristics on the selected risk data; the time domain characteristics include historical time domain characteristics and real-time time domain characteristics; Determine whether the selected risk warning data has historical time domain characteristics; If the selected danger data does not have historical time domain characteristics, it is determined that the selected danger data has real-time time domain characteristics, and the risk level of the selected danger data is determined to be level one, and the risk level of the danger storm is determined to be level one; If the selected risk data has historical time domain characteristics, then determining whether the selected risk data has real-time time domain characteristics; If the selected danger data does not have real-time time domain characteristics, the risk level of the selected danger data is determined to be level 2, and the risk level of the danger storm is determined to be level 2; If the selected danger data has real-time time domain characteristics, frequency analysis and spatial analysis are performed on the danger storm to determine that the risk level of the selected danger data is level one and the risk level of the danger storm is level two.

8. The hierarchical and localized risk network handling method according to claim 7 is characterized in that: The step of registering the graded risk reporting events and locating the causes of the graded risk reporting events includes: Select a critical incident; Determine all the risk data in the selected risk report event; Count the number of high-risk data with a risk level of level 1; Calculate the ratio of the number of high risks to the total amount of risk reporting data of the selected risk reporting event to obtain the risk threshold of the risk reporting event; Determine whether the risk threshold of the selected dangerous event is less than or equal to the acceptance threshold of the dangerous event; If the risk threshold of the selected dangerous event is less than or equal to the collection threshold of the dangerous event, the selected dangerous event will not be included in the archived knowledge, and the process returns to the step of selecting a dangerous event until all dangerous events are selected; If the risk threshold of the selected dangerous alarm event is greater than the acceptance threshold of the dangerous alarm event, the device address anchored by the source of the dangerous alarm data, the problem of the selected dangerous alarm event, and the fault of the selected dangerous alarm event will be used as the cause of the dangerous alarm event, and the process returns to selecting a dangerous alarm event until all dangerous alarm events are selected.

9. The hierarchical and localized risk network handling method according to claim 8 is characterized in that: The archived knowledge of the risk reporting events is formed based on the handling results of the risk reporting events classified by levels and the causes of the risk reporting events classified by levels, including: Select a critical incident; Select a near miss issue; By using the time domain analysis in the time domain characteristic analysis, it is determined whether the problem of the selected dangerous event is the problem of the dangerous event in the real-time dangerous storm; If the problem of the selected dangerous event is a problem of a dangerous event in a real-time dangerous storm, returning to the process of determining the dangerous event, generating a determination result, and updating the topological relationship of the dangerous event until the problem of the selected dangerous event is not a problem of a dangerous event in a real-time dangerous storm; If the selected risk reporting event question is not a risk reporting event question in a real-time risk reporting storm, archived knowledge of the risk reporting event is formed; Return to the question of selecting a risk reporting event until all the risk reporting event questions are completed; Return to the step of selecting a dangerous event until all dangerous events are completed.

10. A hierarchical and localized risk network handling system, characterized in that: include: A server, configured to execute the risk network handling method of hierarchical positioning according to any one of claims 1 to 9; The memory is communicatively connected with the server.

Images