System abnormity alarm method and device

Abstract

The embodiment of the invention provides a system abnormity alarm method and equipment, and the method comprises the steps: obtaining first time sequence data of a monitoring index in a first preset time length range before an alarm triggering moment, and second time sequence data of the monitoring index in a historical comparison time period through responding to an abnormity alarm of the monitoring index; performing image coding by combining the first time sequence data and the second time sequence data to generate a coded image; according to the coded image, calling a preset image model to predict whether the monitoring index can automatically return to normal after the alarm is triggered; and if the prediction monitoring index cannot automatically return to normal after the alarm is triggered, outputting an abnormal alarm message, otherwise, stopping outputting the abnormal alarm message. According to the method, invalid alarms can be effectively reduced, the alarm accuracy is improved, the burden of operation and maintenance personnel is relieved, the intelligent level and the operation and maintenance efficiency of an alarm system are improved, and the method has high universality, can be suitable for any monitoring alarm scene and flexibly adapts to any monitoring index and alarm rule.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer and network communication technology, and more particularly to a system abnormality alarm method and device. Background Art

[0002] In any existing system, such as cloud platforms or distributed systems, system stability and performance are crucial indicators. In order to ensure the normal operation of the system, operation and maintenance personnel need to monitor various monitoring indicators of the system in real time. In order to discover potential problems in the system in a timely manner, it is usually necessary to perform anomaly detection on the monitoring indicators, that is, by analyzing the time series data of the monitoring indicators, find out the abnormal points or abnormal patterns that deviate from the normal values, and then generate alarm information to notify the operation and maintenance personnel to handle it.

[0003] In the prior art, a static threshold alarm method can be used, that is, a fixed threshold is set for the monitoring indicator, and an alarm is triggered when the monitoring indicator exceeds the threshold; a dynamic threshold alarm method can also be used, that is, the alarm threshold is dynamically adjusted by analyzing historical data.

[0004] Although the static threshold alarm method is easy to implement, it is prone to false alarms. Although the dynamic threshold alarm method can reduce some false alarms, it still has shortcomings when dealing with complex trend changes. Monitoring indicators usually have some fluctuations and may return to normal in a short period of time. It is easy to misjudge the normal fluctuations of monitoring indicators through static or dynamic threshold alarm methods, resulting in false alarms, causing interference to operation and maintenance personnel, increasing the burden on operation and maintenance personnel, and reducing operation and maintenance efficiency. Summary of the invention

[0005] The embodiments of the present disclosure provide a system abnormality alarm method and device to effectively reduce invalid alarms, improve alarm accuracy, and reduce the burden on operation and maintenance personnel.

[0006] In a first aspect, an embodiment of the present disclosure provides a system abnormality alarm method, comprising:

[0007] In response to an abnormal alarm of a monitoring indicator, obtaining first time series data of the monitoring indicator within a first preset time range before the alarm triggering moment, and second time series data of the monitoring indicator within a historical comparison time period, wherein the historical comparison time period is a historical time period corresponding to the first preset time range before the alarm triggering moment;

[0008] Combining the first time series data with the second time series data to perform image encoding to generate an encoded image;

[0009] According to the coded image, a preset image model is called to predict whether the monitoring indicator can automatically return to normal after the alarm is triggered through the preset image model; wherein the preset image model is used to output a prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered according to the input coded image;

[0010] If it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered, an abnormal alarm message is output; or, if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered, the output of the abnormal alarm message is stopped.

[0011] In a second aspect, an embodiment of the present disclosure provides a system abnormality alarm device, including:

[0012] An acquisition unit, configured to, in response to an abnormal alarm of a monitoring indicator, acquire first time series data of the monitoring indicator within a first preset time range before the alarm triggering moment, and second time series data of the monitoring indicator within a historical comparison time period, wherein the historical comparison time period is a historical time period corresponding to the first preset time range before the alarm triggering moment;

[0013] an encoding unit, configured to perform image encoding on the first time series data and the second time series data to generate an encoded image;

[0014] A prediction unit, configured to call a preset image model according to the coded image, and predict whether the monitoring indicator can automatically return to normal after the alarm is triggered by the preset image model; wherein the preset image model is used to output a prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered according to the input coded image;

[0015] The output unit is used to output an abnormal alarm message if it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered; or to stop outputting the abnormal alarm message if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered.

[0016] In a third aspect, an embodiment of the present disclosure provides an electronic device, including: a processor and a memory;

[0017] The memory stores computer-executable instructions;

[0018] The processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the system abnormality alarm method described in the first aspect and various possible designs of the first aspect.

[0019] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the system abnormality alarm method described in the first aspect and various possible designs of the first aspect is implemented.

[0020] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the system abnormality alarm method as described in the first aspect and various possible designs of the first aspect.

[0021] The system abnormality alarm method and device provided by the embodiments of the present disclosure obtain, in response to the abnormal alarm of the monitoring indicator, the first time series data of the monitoring indicator within the first preset time range before the alarm triggering moment, and the second time series data of the monitoring indicator within the historical comparison time period, wherein the historical comparison time period is the historical time period corresponding to the first preset time range before the alarm triggering moment; image encoding is performed on the first time series data and the second time series data to generate an encoded image; based on the encoded image, a preset image model is called to predict whether the monitoring indicator can automatically return to normal after the alarm is triggered through the preset image model, wherein the preset image model is used to output a prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered according to the input encoded image; if it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered, an abnormal alarm message is output; or, if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered, the output of the abnormal alarm message is stopped. By performing image encoding on the first time series data within the first preset time range before the alarm triggering moment and the second time series data of the monitoring indicators within the historical comparison time period, and predicting whether the monitoring indicators can automatically return to normal after the alarm is triggered based on the image model, it can effectively reduce invalid alarms, improve alarm accuracy, reduce the burden on operation and maintenance personnel, and improve the intelligence level and operation and maintenance efficiency of the alarm system. It has strong versatility, can be applied to any monitoring alarm scenario, and can flexibly adapt to any monitoring indicators and alarm rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0023] Figure 1 A schematic diagram of a scenario of a system abnormality alarm method provided by an embodiment of the present disclosure;

[0024] Figure 2 A schematic diagram of a system abnormality alarm method flow chart provided in an embodiment of the present disclosure;

[0025] Figure 3a A schematic diagram of normalized first time series data and second time series data provided by an embodiment of the present disclosure;

[0026] Figure 3b A schematic diagram of a grayscale image provided by an embodiment of the present disclosure;

[0027] Figure 4 A structural block diagram of a fully connected classifier of a preset image model provided in an embodiment of the present disclosure;

[0028] Figure 5 A structural block diagram of a system abnormality alarm device provided in an embodiment of the present disclosure;

[0029] Figure 6 A schematic diagram of the hardware structure of a system abnormality alarm device provided in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0031] In the prior art, a static threshold alarm method can be adopted, that is, a fixed threshold is set for the monitoring indicator, and an alarm will be triggered when the monitoring indicator exceeds the threshold; a dynamic threshold alarm method can also be adopted, that is, by analyzing historical data, the alarm threshold is dynamically adjusted, for example, different time period thresholds are set based on historical periodic fluctuations.

[0032] Although the static threshold alarm method is easy to implement, it is prone to false alarms. Although the dynamic threshold alarm method can reduce some false alarms, it still has shortcomings when dealing with complex trend changes. Monitoring indicators usually have some fluctuations and may return to normal in a short period of time. It is easy to misjudge the normal fluctuations of monitoring indicators through static or dynamic threshold alarm methods, resulting in false alarms, causing interference to operation and maintenance personnel, increasing the burden on operation and maintenance personnel, and reducing operation and maintenance efficiency.

[0033] In order to solve the above technical problems, the embodiment of the present disclosure provides a system abnormality alarm method, which can first determine whether the monitoring indicator can automatically return to normal after the alarm is triggered. If it can automatically return to normal, no alarm is needed. If it cannot automatically return to normal, an alarm is issued. In order to achieve the above purpose, the first time series data within the first preset time range before the alarm triggering moment and the second time series data of the monitoring indicator in the historical comparison time period can be image encoded, and based on the image model, it is predicted whether the monitoring indicator can automatically return to normal after the alarm is triggered, thereby effectively reducing invalid alarms, improving alarm accuracy, reducing the burden on operation and maintenance personnel, and improving the intelligence level and operation and maintenance efficiency of the alarm system. It has strong versatility, can be applicable to any monitoring alarm scenario, and can be flexibly adapted to any monitoring indicators and alarm rules.

[0034] The application scenarios of the system abnormality alarm method of the embodiment of the present disclosure are as follows: Figure 1 As shown, a preset image model can also be pre-trained to predict whether the indicator can automatically return to normal after the alarm is triggered. Training data can be collected first, including a large amount of historical alarm data, and the third time series data of the monitoring indicator within the first preset time range before the alarm triggering moment, and the fourth time series data of the monitoring indicator within the historical comparison time period are extracted, and the third time series data and the fourth time series data are image-encoded to generate an encoded image, and manually annotate whether the monitoring indicator automatically recovers in a short time. The preset image model is trained based on the above training data, and after the training is completed, the preset image model can be deployed in the monitoring system.

[0035] During the application stage, when an abnormal alarm is triggered by a monitoring indicator, the first time series data of the monitoring indicator within the first preset time range before the alarm is triggered, and the second time series data of the monitoring indicator within the historical comparison time period can be obtained; image encoding is performed on the first time series data and the second time series data to generate a coded image; based on the coded image, a preset image model is called to predict whether the monitoring indicator can automatically return to normal after the alarm is triggered through the preset image model; if it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered, an abnormal alarm message is output.

[0036] It should be noted that the data involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0037] The system abnormality alarm method disclosed in the present invention will be described in detail below in conjunction with specific embodiments.

[0038] refer to Figure 2 , Figure 2A schematic diagram of a system abnormality alarm method flow chart provided in an embodiment of the present disclosure. The method of this embodiment can be applied in a terminal device or a server, and the system abnormality alarm method includes:

[0039] S201. In response to an abnormal alarm of a monitoring indicator, obtain first time series data of the monitoring indicator within a first preset time range before the alarm triggering moment, and second time series data of the monitoring indicator within a historical comparison time period, wherein the historical comparison time period is a historical time period corresponding to the first preset time range before the alarm triggering moment.

[0040] In this embodiment, one or more monitoring indicators of the current system can be monitored, and it can be determined whether the monitoring indicators are abnormal. If an abnormality occurs, an abnormal alarm is triggered. The monitoring indicators may be normal fluctuations and false alarms, and can automatically return to normal in a short time, or they may really be abnormal and cannot automatically return to normal in a short time. Only when an abnormality really occurs and cannot automatically return to normal in a short time, an alarm is required to notify the operation and maintenance personnel to handle it. The current system can be any system in any application scenario, and there is no restriction in this embodiment, such as cloud platforms, distributed systems, etc. The monitoring indicators can be any indicators, such as but not limited to basic resource indicators such as CPU usage, memory usage, network traffic, disk I / O, and business-level performance indicators such as response time and request error rate, etc.

[0041] In order to achieve the above-mentioned purpose, in the present embodiment, when an abnormal alarm is generated for a monitoring indicator, first time series data of the monitoring indicator within the first preset time range before the alarm triggering moment can be obtained, wherein the first time series data may include data of the monitoring indicator at the alarm triggering moment; in addition, in order to better capture the periodic fluctuation of the monitoring indicator, as comparison data of the first time series data, one or more historical comparison time periods can be selected to obtain second time series data of the monitoring indicator within the historical comparison time period, wherein the historical comparison time period is a historical time period corresponding to the first preset time range before the alarm triggering moment, such as the same time period of the previous day or multiple days as the historical comparison time period, or the monitoring indicator has a certain periodicity, and the same time period of the previous one or more cycles can be selected as the historical comparison time period. Optionally, the first time series data and the second time series data can be sampled at specific time intervals within their respective corresponding time ranges.

[0042] Optionally, the length of the historical comparison time period can be the same as the first preset time period. This is because by comparing the changing trend of the second time series data in the historical comparison time period with the changing trend of the first time series data within the first preset time period before the alarm trigger moment, if the changing trends are consistent or similar, it is necessary to further determine whether the monitoring indicators have not shown any abnormalities after the historical comparison time period, or whether the monitoring indicators have automatically returned to normal within a short time after the abnormalities have occurred after the historical comparison time period, in order to predict whether the current alarm can automatically return to normal after being triggered.

[0043] Optionally, in order to avoid the need for the above-mentioned further judgment on whether the monitoring indicators have not shown any abnormalities after the historical comparison time period, or whether the monitoring indicators have automatically returned to normal in a short time after the abnormalities have occurred after the historical comparison time period, the duration of the historical comparison time period can be configured in this embodiment to be longer than the first preset time period before the alarm triggering moment, which can reflect the changing trend of the monitoring indicators after the historical comparison time period, that is, whether the monitoring indicators have not shown any abnormalities after the historical comparison time period, or whether the monitoring indicators have automatically returned to normal in a short time after the abnormalities have occurred after the historical comparison time period. Therefore, the historical comparison time period includes at least the first preset time range before the historical moment corresponding to the alarm triggering moment and the second preset time range after the historical moment (or it can also be a longer time range), wherein the historical moment corresponding to the alarm triggering moment can be the same moment as the alarm triggering moment one or more days before, or the monitoring indicator has a certain periodicity, and the historical moment corresponding to the alarm triggering moment can be the same moment as the alarm triggering moment in the previous one or more cycles.

[0044] For example, the first preset time is 60 minutes, the second preset time is 5 minutes, and the sampling time interval is 1 minute. The first time series data is the data of the monitoring indicator within 60 minutes before the alarm triggering moment, with a total of 61 data; and the historical comparison time period includes 60 minutes before the historical moment corresponding to the alarm triggering moment and 5 minutes after the historical moment, a total of 65 minutes. The second time series data is the data of the monitoring indicator within the historical comparison time period, with a total of 66 data. Specifically, assuming that the alarm triggering moment is 12:00 on October 14, the first time series data is the data of the monitoring indicator within 60 minutes before the alarm triggering moment, that is, from 11:00 to 12:00 on October 14, with a total of 61 data; the historical moment corresponding to the alarm triggering moment can be 12:00 on October 13, and the historical comparison time period is 11:00-12:05 on October 13, then the second time series data is the data of the monitoring indicator from 11:00 to 12:05 on October 13, with a total of 66 data.

[0045] It should be noted that when monitoring the monitoring indicators of the current system and judging whether the monitoring indicators are abnormal, a static threshold alarm method can be adopted, that is, a fixed threshold is set in advance to judge whether the monitoring indicators exceed the fixed threshold. If it exceeds, an abnormality occurs and an alarm is triggered; or a dynamic threshold alarm method can be adopted to dynamically adjust the threshold and judge whether the monitoring indicators exceed the threshold. If it exceeds, it is determined that an abnormality occurs and an alarm is triggered; or an adaptive alarm can be adopted to judge whether an abnormality occurs and trigger an alarm through intelligent methods such as machine learning; of course, any other feasible method can also be used to judge whether an abnormality occurs, which is not limited in this embodiment.

[0046] S202: Perform image encoding on the first time series data and the second time series data to generate an encoded image.

[0047] In this embodiment, the first time series data and the second time series data can be encoded into an image format so that the preset image model can be used to automatically analyze these time series data. By utilizing the preset image model's ability to process and understand visual information, it is possible to make a judgment on whether the monitoring indicators can automatically return to normal after the alarm is triggered by observing the curve graph just like humans.

[0048] Specifically, the image encoding of the first time series data and the second time series data can be performed in any feasible manner, such as drawing a curve graph (for example, the horizontal axis is time, and the vertical axis is the numerical value of the first time series data and the second time series data), a grayscale image, or other images to represent the data in a graphical manner.

[0049] Optionally, a grayscale image may be used to represent the first time series data and the second time series data, which is simpler and easier to be understood by a subsequent preset image model. Specifically, the first time series data and the second time series data may be normalized, respectively, and the normalized first time series data and the second time series data may be used as row features of the grayscale image, respectively, and the generated grayscale image may be used as the encoded image.

[0050] In this embodiment, in order to eliminate the dimensional differences between different monitoring indicators and avoid the influence of the learning effect of the model due to the absolute numerical difference, so that the preset image model has universality and can adapt to various monitoring alarm scenarios and different monitoring indicators, the first time series data and the second time series data can be normalized respectively. Optionally, when normalizing the first time series data, the maximum value and the minimum value of the first time series data are selected, and each data in the first time series data is normalized according to the maximum value and the minimum value of the first time series data, that is, the difference between each data and the minimum value is divided by the difference between the maximum value and the minimum value; when normalizing the second time series data, the maximum value and the minimum value of the second time series data are selected, and each data of the second time series data is normalized according to the maximum value and the minimum value of the second time series data, and the method is the same as above. Then, the normalized first time series data and the second time series data are used as the row features of the grayscale image respectively, and the generated grayscale image is used as the encoded image. Alternatively, when normalizing the first time series data, the difference between each data in the first time series data and the mean of the first time series data may be divided by the standard deviation of the first time series data; when normalizing the second time series data, the difference between each data in the second time series data and the mean of the second time series data may be divided by the standard deviation of the second time series data; or other methods may be used for normalization.

[0051] In a specific implementation, the normalized first time series data and the second time series data can be respectively used as different rows of pixels of a grayscale image, the grayscale image is generated according to the different rows of pixels, and the generated grayscale image is used as the encoded image.

[0052] In this embodiment, a row of pixels can be constructed with the normalized first time series data as the grayscale value; if there is only one historical comparison time period, there is only one set of second time series data, and a row of pixels can also be constructed with the normalized second time series data as the grayscale value; if there are multiple historical comparison time periods, there are multiple sets of second time series data, and a row of pixels can be constructed with each set of normalized second time series data as the grayscale value, and multiple rows of pixels can be obtained; the above-mentioned rows of pixels are aligned and combined to obtain multiple rows of pixels, and a grayscale image is constructed based on the multiple rows of pixels.

[0053] Optionally, in one of the above embodiments, the duration of the historical comparison time period is longer than the first preset duration before the alarm triggering moment, and the second time series data is more than the first time series data (for example, in the above example, the second time series data includes 66 data, and the first time series data includes 61 data). The first time series data and the second time series data can be aligned before image encoding, and the part where the first time series data and the second time series data cannot be aligned is filled with empty data, so that the padded first time series data can be aligned one by one with the second time series data. For example, in the above example, 5 empty data (that is, 0) can be padded after the first time series data, and the padded first time series data has 66 data, which can be aligned one by one with the second time series data. Then, when constructing row pixels, the number of pixels in each row of pixels is the same.

[0054] Optionally, since the grayscale image is used as the encoded image and is the input of the preset image model, it is necessary to meet the requirements of the preset image model for the input image, such as the requirements on the image size. If the preset image model has no requirements on the size of the input image, the row pixels corresponding to the normalized first time series data and the second time series data are directly spliced ​​to obtain the grayscale image; if the preset image model requires the input image to meet the preset size requirements, and the row features (row pixels) corresponding to the normalized first time series data and the second time series data do not meet the preset size requirements when they are directly spliced, it is necessary to obtain an image that meets the preset size requirements by copying the row features corresponding to the normalized first time series data and the second time series data as a grayscale image. As an example, if the preset image The model requires that the input image has the same width and height, that is, the input image is a square image. The row pixels corresponding to the normalized first time series data and the second time series data can be copied multiple times so that the number of rows is equal to the number of row pixels. For example, in the above example, the number of pixels in a row is 66, and the row pixels corresponding to the first time series data and the second time series data have 2 rows. The two rows of pixels can be copied 33 times in the vertical direction, that is, a total of 66 rows, so that a 66×66 square image can be formed. For example, the normalized first time series data and the second time series data are as follows: Figure 3a As shown, the solid line is the normalized first time series data, and the dotted line is the normalized second time series data. The constructed grayscale image can be as follows Figure 3b As shown, the size requirement of the preset image model for the input image can be met, ensuring that the preset image model can be input, while also maintaining the original characteristics of the time series data.

[0055] Of course, generating a grayscale image is not limited to the above method, and other feasible methods may also be used, such as differentiating the normalized first time series data and the second time series data and mapping them to grayscale values ​​to generate a grayscale image, or directly mapping the first time series data and the second time series data to grayscale values ​​to generate a grayscale image, etc.

[0056] S203. According to the encoded image, call the preset image model, and use the preset image model to predict whether the monitoring indicator can automatically return to normal after the alarm is triggered; wherein the preset image model is used to output the prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered based on the input encoded image.

[0057] In this embodiment, a preset image model can be pre-trained so that the preset image model can predict whether the monitoring index can automatically return to normal after the alarm is triggered based on the input coded image. The preset image model can be any image model that can perform image processing, and this embodiment does not limit it.

[0058] In a specific implementation, the current encoded image may be input into a preset image model, and the preset image model may be used to predict whether the detection index can automatically return to normal after the alarm is triggered.

[0059] S204: if it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered, output an abnormal alarm message; or, if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered, stop outputting the abnormal alarm message.

[0060] In this embodiment, through the above steps, if the predicted monitoring indicator cannot automatically return to normal after the alarm is triggered, manual intervention is required, and an abnormal alarm message can be output, such as sending an abnormal alarm message to the terminal of the operation and maintenance personnel, or displaying the abnormal alarm message on the screen, playing the abnormal alarm message through the speaker, etc.; of course, if the predicted monitoring indicator can automatically return to normal after the alarm is triggered, no manual intervention is required, and no abnormal alarm message is output. Through the above process, invalid alarms can be significantly reduced, and the workload of operation and maintenance personnel in handling invalid alarms can be reduced; in addition, a prediction prompt of whether it can automatically return to normal can also be provided in the abnormal alarm message, so that the operation and maintenance personnel can more quickly determine whether the abnormal alarm message needs emergency processing, thereby optimizing the alarm processing process.

[0061] The system abnormality alarm method provided in the present embodiment obtains, in response to the abnormal alarm of the monitoring indicator, the first time series data of the monitoring indicator within the first preset time range before the alarm triggering moment, and the second time series data of the monitoring indicator within the historical comparison time period, wherein the historical comparison time period is the historical time period corresponding to the first preset time range before the alarm triggering moment; performs image encoding on the first time series data and the second time series data to generate an encoded image; based on the encoded image, calls a preset image model, and predicts whether the monitoring indicator can automatically return to normal after the alarm is triggered through the preset image model, wherein the preset image model is used to output a prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered according to the input encoded image; if it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered, outputs an abnormal alarm message; or, if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered, stops outputting the abnormal alarm message. By performing image encoding on the first time series data within the first preset time range before the alarm triggering moment and the second time series data of the monitoring indicators within the historical comparison time period, and predicting whether the monitoring indicators can automatically return to normal after the alarm is triggered based on the image model, it can effectively reduce invalid alarms, improve alarm accuracy, reduce the burden on operation and maintenance personnel, and improve the intelligence level and operation and maintenance efficiency of the alarm system. It has strong versatility, can be applied to any monitoring alarm scenario, and can flexibly adapt to any monitoring indicators and alarm rules.

[0062] Based on any of the above embodiments, the preset image model can be as follows: Figure 1 As shown in , it includes an encoder and a fully connected classifier. The encoder is used to extract an image feature vector from the encoded image; and the fully connected classifier is used to classify according to the image feature vector, and the classification result is that the monitoring indicator can automatically return to normal after the alarm is triggered, or the monitoring indicator cannot automatically return to normal after the alarm is triggered.

[0063] In the specific implementation, the encoded image is input into the preset image model, and the image feature vector of the encoded image can be first extracted through the encoder of the preset image model; the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered is determined according to the image feature vector through the fully connected classifier of the preset image model, and the prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered is obtained according to the probability value.

[0064] In an optional embodiment, the encoder of the preset image model may adopt an encoder (Encoder) of the Vision Transformer (ViT) architecture. The reason for selecting the ViT model is that the ViT model has powerful global and local feature extraction capabilities, and is particularly suitable for complex image pattern analysis; and unlike the traditional CNN model, the ViT model can better process long sequence image features and is suitable for processing encoded time series data; the model has been pre-trained on a large-scale image dataset, can quickly adapt to specific tasks, and reduces training time and computing resource consumption.

[0065] In this embodiment, the encoded image can be segmented, and each local image can be embedded (Embedding) to be converted into a vector. The encoded image is also embedded to be converted into a vector, and the vector of the encoded image and the vector of the local image are input into the encoder of ViT. The encoder of ViT may include multiple Transformer layers. Through the superposition of multiple Transformer layers, local image features and global image features can be captured, and a set of high-dimensional image feature vectors, such as 768-dimensional image feature vectors, can be output. Among them, the encoder of ViT includes a normalization (Norm) layer for standardizing the distribution of input data; a multi-head self-attention mechanism (Multi-Head Self-Attention) layer for capturing the dependency between different positions in the input data through the self-attention mechanism; a forward feedback neural network (Multi-Layer Perceptron, MLP) layer for further nonlinear transformation of the features processed by the self-attention mechanism. The specific process is not repeated here.

[0066] In an optional embodiment, the fully connected classifier of the preset image model may include a fully connected layer, an activation function and an output layer. The fully connected layer is used to reduce the dimension of the image feature vector; the activation function is used to perform a nonlinear transformation on the image feature vector after the dimension reduction; the output layer is used to map the nonlinear transformation result to a probability value, and may include a fully connected layer and a Sigmoid function, which can output a probability value between 0 and 1, which is used to represent the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered.

[0067] Optional, such as Figure 4 As shown, the fully connected classifier may include two fully connected layers, each fully connected layer is connected to the activation function, and after nonlinear transformation, is connected to the next fully connected layer.

[0068] Optionally, the activation function can use the LeakyReLU activation function, which can avoid the problem of neuron death and enhance the nonlinear representation ability of the model.

[0069] In the specific implementation, the image feature vector output by the encoder is input into the fully connected classifier, and the image feature vector is reduced in dimension through the fully connected layer; the image feature vector after dimensionality reduction is nonlinearly transformed through the activation function; the nonlinear transformation result is mapped to a probability value through the output layer, which serves as the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered; and then a binary classification mechanism is used for judgment. When the output value is greater than 0.5, it indicates that the monitoring indicator is likely to automatically return to normal after the alarm is triggered; when the output value is not greater than 0.5, it indicates that the alarm may require manual intervention.

[0070] Based on any of the above embodiments, the preset image model may be trained in advance, as shown below:

[0071] Collect training data: First, a large amount of historical alarm data can be collected as the basis for training the model. Specifically, the data of monitoring indicators before each abnormal alarm is generated can be collected, and combined with the feedback of operation and maintenance personnel, it is marked whether the monitoring indicators in these historical abnormal alarms are automatically restored in a short time. The specific steps of data collection are similar to the above S201, including:

[0072] 1) Obtain the third time series data of the monitoring indicator within the first preset time range before the alarm triggering moment; obtain the fourth time series data of the monitoring indicator within the historical comparison time period;

[0073] 2) performing image encoding on the third time series data and the fourth time series data;

[0074] 3) Based on historical operation and maintenance experience, manually judge whether the monitoring indicators in each abnormal alarm are automatically restored in a short time. The labeling results are used as labels for supervised learning and used to train the model.

[0075] Training set and test set division: The collected historical alarm data is divided into training set, validation set and test set. For example, the division can be in a ratio of 6:2:2 to ensure that the model can be effectively evaluated after training.

[0076] Loss function: Since the task of this disclosure is a binary classification problem, a binary cross entropy loss function can be used as the objective function. This loss function can effectively measure the difference between the model's predicted value and the actual label, and is defined as follows:

[0077]

[0078] Among them, y i is the actual label (whether the monitoring indicator is automatically restored in a short time, corresponding to 1 and 0 respectively), p i is the predicted probability (the output of the model), and N is the number of samples.

[0079] Optimization algorithm: The Adam optimization algorithm (Adaptive Moment Estimation) is used to optimize model parameters. The Adam algorithm combines the advantages of momentum and adaptive learning rate adjustment, can converge quickly, and is suitable for processing large-scale data training. The learning rate is set to 0.001 and is dynamically adjusted according to the performance of the validation set during training.

[0080] Training process: During the training process, the preset image model continuously adjusts parameters through back propagation, so that the predicted automatic recovery probability value gradually approaches the actual annotation value. The early stopping mechanism is used to avoid overfitting, and the generalization ability of the model is ensured through cross-validation.

[0081] After the preset image model is trained and verified by the test set, the preset image model can be deployed to the actual alarm system.

[0082] Corresponding to the system abnormality alarm method in the above embodiment, Figure 5 This is a structural block diagram of a system abnormality alarm device provided by an embodiment of the present disclosure. For ease of explanation, only the parts related to the embodiment of the present disclosure are shown. Figure 5 The system abnormality alarm device 500 includes: an acquisition unit 501, an encoding unit 502, a prediction unit 503, and an output unit 504.

[0083] Among them, the acquisition unit 501 is used to respond to the abnormal alarm of the monitoring indicator, obtain the first time series data of the monitoring indicator within the first preset time range before the alarm triggering moment, and the second time series data of the monitoring indicator within the historical comparison time period, wherein the historical comparison time period is the historical time period corresponding to the first preset time range before the alarm triggering moment;

[0084] An encoding unit 502, configured to perform image encoding on the first time series data and the second time series data to generate an encoded image;

[0085] The prediction unit 503 is used to call a preset image model according to the coded image, and predict whether the monitoring indicator can automatically return to normal after the alarm is triggered through the preset image model; wherein the preset image model is used to output a prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered according to the input coded image;

[0086] The output unit 504 is used to output an abnormal alarm message if it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered; or to stop outputting the abnormal alarm message if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered.

[0087] In one or more embodiments of the present disclosure, when the encoding unit 502 performs image encoding on the first time series data and the second time series data to generate an encoded image, it is configured to:

[0088] The first time series data and the second time series data are normalized respectively, and the normalized first time series data and the second time series data are used as row features of a grayscale image respectively, and the generated grayscale image is used as the encoded image.

[0089] In one or more embodiments of the present disclosure, when the encoding unit 502 uses the normalized first time series data and the second time series data as row features of a grayscale image respectively, and uses the generated grayscale image as the encoded image, it is configured to:

[0090] The normalized first time series data and the second time series data are respectively used as different rows of pixels of a grayscale image, the grayscale image is generated according to the different rows of pixels, and the generated grayscale image is used as the encoded image.

[0091] In one or more embodiments of the present disclosure, when the encoding unit 502 uses the normalized first time series data and the second time series data as row features of a grayscale image respectively, and uses the generated grayscale image as the encoded image, it is configured to:

[0092] Determine whether the size of the row features corresponding to the normalized first time series data and the second time series data meets the preset image size requirement. If not, a grayscale image consisting of multiple rows of row features that meet the preset image size requirement is obtained by multiple copying of the row features corresponding to the normalized first time series data and the second time series data.

[0093] In one or more embodiments of the present disclosure, the historical comparison time period includes a first preset time range before the historical moment corresponding to the alarm triggering moment and a second preset time range after the historical moment.

[0094] In one or more embodiments of the present disclosure, before the encoding unit 502 performs image encoding on the first time series data and the second time series data, it is further configured to:

[0095] The first time series data and the second time series data are aligned, and empty data are filled in the part where the first time series data and the second time series data cannot be aligned, so that the padded first time series data can be aligned one-to-one with the second time series data.

[0096] In one or more embodiments of the present disclosure, the preset image model includes an encoder and a fully connected classifier; accordingly, when the prediction unit 503 predicts whether the monitoring indicator can automatically return to normal after the alarm is triggered through the preset image model, it is used to:

[0097] Extracting an image feature vector from the encoded image through an encoder of the preset image model;

[0098] Through the fully connected classifier of the preset image model, the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered is determined according to the image feature vector, and the prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered is obtained according to the probability value.

[0099] In one or more embodiments of the present disclosure, when the prediction unit 503 determines the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered according to the image feature vector through the fully connected classifier of the preset image model, it is used to:

[0100] Performing dimensionality reduction on the image feature vector through a fully connected layer of the fully connected classifier;

[0101] Performing a nonlinear transformation on the image feature vector after dimensionality reduction by using the activation function of the fully connected classifier;

[0102] The nonlinear transformation result is mapped into a probability value through the output layer of the fully connected classifier, which serves as the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered.

[0103] In one or more embodiments of the present disclosure, the prediction unit 503 is further configured to:

[0104] Acquire a plurality of training data, wherein each training data includes a pre-acquired coded image and a preset label indicating whether the corresponding monitoring indicator can automatically return to normal after an alarm is triggered;

[0105] According to the training data and the preset loss function, a preset optimization algorithm is used to optimize the parameters of the preset image model.

[0106] The device provided in this embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be repeated here.

[0107] In order to implement the above embodiment, the embodiment of the present disclosure also provides an electronic device.

[0108] refer to Figure 6, which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present disclosure, and the electronic device 600 may be a terminal device or a server. The terminal device may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, personal digital assistants (PDAs), tablet computers, portable multimedia players (PMPs), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0109] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 to a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0110] Typically, the following devices may be connected to the I / O interface 605: input devices 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 608 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0111] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0112] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0113] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0114] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0115] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0116] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0117] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0118] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0119] In a first aspect, according to one or more embodiments of the present disclosure, a system abnormality alarm method is provided, comprising:

[0120] In response to an abnormal alarm of a monitoring indicator, obtaining first time series data of the monitoring indicator within a first preset time range before the alarm triggering moment, and second time series data of the monitoring indicator within a historical comparison time period, wherein the historical comparison time period is a historical time period corresponding to the first preset time range before the alarm triggering moment;

[0121] Combining the first time series data with the second time series data to perform image encoding to generate an encoded image;

[0122] According to the coded image, a preset image model is called to predict whether the monitoring indicator can automatically return to normal after the alarm is triggered through the preset image model; wherein the preset image model is used to output a prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered according to the input coded image;

[0123] If it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered, an abnormal alarm message is output; or, if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered, the output of the abnormal alarm message is stopped.

[0124] According to one or more embodiments of the present disclosure, the combining the first time series data and the second time series data to perform image encoding to generate an encoded image includes:

[0125] The first time series data and the second time series data are normalized respectively, and the normalized first time series data and the second time series data are used as row features of a grayscale image respectively, and the generated grayscale image is used as the encoded image.

[0126] According to one or more embodiments of the present disclosure, the normalized first time series data and the second time series data are used as row features of a grayscale image respectively, and the generated grayscale image is used as the encoded image, including:

[0127] The normalized first time series data and the second time series data are respectively used as different rows of pixels of a grayscale image, the grayscale image is generated according to the different rows of pixels, and the generated grayscale image is used as the encoded image.

[0128] According to one or more embodiments of the present disclosure, the step of using the normalized first time series data and the second time series data as row features of a grayscale image, and using the generated grayscale image as the encoded image, includes:

[0129] Determine whether the size of the row features corresponding to the normalized first time series data and the second time series data meets the preset image size requirement. If not, a grayscale image consisting of multiple rows of row features that meet the preset image size requirement is obtained by multiple copying of the row features corresponding to the normalized first time series data and the second time series data.

[0130] According to one or more embodiments of the present disclosure, the historical comparison time period includes a first preset time range before the historical moment corresponding to the alarm triggering moment and a second preset time range after the historical moment.

[0131] According to one or more embodiments of the present disclosure, before the image encoding is performed by combining the first time series data and the second time series data, the method further includes:

[0132] The first time series data and the second time series data are aligned, and empty data are filled in the part where the first time series data and the second time series data cannot be aligned, so that the padded first time series data can be aligned one-to-one with the second time series data.

[0133] According to one or more embodiments of the present disclosure, the preset image model includes an encoder and a fully connected classifier; accordingly, predicting whether the monitoring indicator can automatically return to normal after the alarm is triggered by the preset image model includes:

[0134] Extracting an image feature vector from the encoded image through an encoder of the preset image model;

[0135] Through the fully connected classifier of the preset image model, the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered is determined according to the image feature vector, and the prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered is obtained according to the probability value.

[0136] According to one or more embodiments of the present disclosure, the fully connected classifier of the preset image model determines the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered according to the image feature vector, including:

[0137] Performing dimensionality reduction on the image feature vector through a fully connected layer of the fully connected classifier;

[0138] Performing a nonlinear transformation on the image feature vector after dimensionality reduction by using the activation function of the fully connected classifier;

[0139] The nonlinear transformation result is mapped into a probability value through the output layer of the fully connected classifier, which serves as the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered.

[0140] According to one or more embodiments of the present disclosure, the method further includes:

[0141] Acquire a plurality of training data, wherein each training data includes a pre-acquired coded image and a preset label indicating whether the corresponding monitoring indicator can automatically return to normal after an alarm is triggered;

[0142] According to the training data and the preset loss function, a preset optimization algorithm is used to optimize the parameters of the preset image model.

[0143] In a second aspect, according to one or more embodiments of the present disclosure, a system abnormality alarm device is provided, including:

[0144] An acquisition unit, configured to, in response to an abnormal alarm of a monitoring indicator, acquire first time series data of the monitoring indicator within a first preset time range before the alarm triggering moment, and second time series data of the monitoring indicator within a historical comparison time period, wherein the historical comparison time period is a historical time period corresponding to the first preset time range before the alarm triggering moment;

[0145] an encoding unit, configured to perform image encoding on the first time series data and the second time series data to generate an encoded image;

[0146] A prediction unit, configured to call a preset image model according to the coded image, and predict whether the monitoring indicator can automatically return to normal after the alarm is triggered by the preset image model; wherein the preset image model is used to output a prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered according to the input coded image;

[0147] The output unit is used to output an abnormal alarm message if it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered; or to stop outputting the abnormal alarm message if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered.

[0148] According to one or more embodiments of the present disclosure, when the encoding unit performs image encoding on the first time series data and the second time series data to generate an encoded image, it is configured to:

[0149] The first time series data and the second time series data are normalized respectively, and the normalized first time series data and the second time series data are used as row features of a grayscale image respectively, and the generated grayscale image is used as the encoded image.

[0150] According to one or more embodiments of the present disclosure, when the encoding unit uses the normalized first time series data and the second time series data as row features of a grayscale image respectively, and uses the generated grayscale image as the encoded image, it is configured to:

[0151] The normalized first time series data and the second time series data are respectively used as different rows of pixels of a grayscale image, the grayscale image is generated according to the different rows of pixels, and the generated grayscale image is used as the encoded image.

[0152] According to one or more embodiments of the present disclosure, when the encoding unit uses the normalized first time series data and the second time series data as row features of a grayscale image respectively, and uses the generated grayscale image as the encoded image, it is configured to:

[0153] Determine whether the size of the row features corresponding to the normalized first time series data and the second time series data meets the preset image size requirement. If not, a grayscale image consisting of multiple rows of row features that meet the preset image size requirement is obtained by multiple copying of the row features corresponding to the normalized first time series data and the second time series data.

[0154] According to one or more embodiments of the present disclosure, the historical comparison time period includes a first preset time range before the historical moment corresponding to the alarm triggering moment and a second preset time range after the historical moment.

[0155] According to one or more embodiments of the present disclosure, before the encoding unit performs image encoding on the first time series data and the second time series data, the encoding unit is further configured to:

[0156] The first time series data and the second time series data are aligned, and empty data are filled in the part where the first time series data and the second time series data cannot be aligned, so that the padded first time series data can be aligned one-to-one with the second time series data.

[0157] According to one or more embodiments of the present disclosure, the preset image model includes an encoder and a fully connected classifier; accordingly, when the prediction unit predicts whether the monitoring indicator can automatically return to normal after the alarm is triggered through the preset image model, it is used to:

[0158] Extracting an image feature vector from the encoded image through an encoder of the preset image model;

[0159] Through the fully connected classifier of the preset image model, the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered is determined according to the image feature vector, and the prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered is obtained according to the probability value.

[0160] According to one or more embodiments of the present disclosure, when the prediction unit determines the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered according to the image feature vector through the fully connected classifier of the preset image model, it is used to:

[0161] Performing dimensionality reduction on the image feature vector through a fully connected layer of the fully connected classifier;

[0162] Performing a nonlinear transformation on the image feature vector after dimensionality reduction by using the activation function of the fully connected classifier;

[0163] The nonlinear transformation result is mapped into a probability value through the output layer of the fully connected classifier, which serves as the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered.

[0164] According to one or more embodiments of the present disclosure, the prediction unit is further configured to:

[0165] Acquire a plurality of training data, wherein each training data includes a pre-acquired coded image and a preset label indicating whether the corresponding monitoring indicator can automatically return to normal after an alarm is triggered;

[0166] According to the training data and the preset loss function, a preset optimization algorithm is used to optimize the parameters of the preset image model.

[0167] In a third aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device, comprising: at least one processor and a memory;

[0168] The memory stores computer-executable instructions;

[0169] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the system abnormality alarm method described in the first aspect and various possible designs of the first aspect.

[0170] In a fourth aspect, according to one or more embodiments of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer execution instructions. When a processor executes the computer execution instructions, the system abnormality alarm method described in the first aspect and various possible designs of the first aspect is implemented.

[0171] In a fifth aspect, according to one or more embodiments of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the system abnormality alarm method described in the first aspect and various possible designs of the first aspect is implemented.

[0172] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0173] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0174] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A system abnormality alarm method, characterized in that: include: In response to an abnormal alarm of a monitoring indicator, obtaining first time series data of the monitoring indicator within a first preset time range before the alarm triggering moment, and second time series data of the monitoring indicator within a historical comparison time period, wherein the historical comparison time period is a historical time period corresponding to the first preset time range before the alarm triggering moment; Combining the first time series data with the second time series data to perform image encoding to generate an encoded image; According to the coded image, a preset image model is called to predict whether the monitoring indicator can automatically return to normal after the alarm is triggered through the preset image model; wherein the preset image model is used to output a prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered according to the input coded image; If it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered, an abnormal alarm message is output; or, if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered, the output of the abnormal alarm message is stopped.

2. The method according to claim 1, characterized in that The combining the first time series data and the second time series data to perform image encoding to generate an encoded image includes: Normalizing the first time series data and the second time series data respectively; The normalized first time series data and the second time series data are respectively used as row features of the grayscale image, and the generated grayscale image is used as the encoded image.

3. The method according to claim 2, characterized in that The step of using the normalized first time series data and the second time series data as row features of a grayscale image respectively, and using the generated grayscale image as the encoded image, comprises: The normalized first time series data and the second time series data are respectively used as different rows of pixels of a grayscale image, the grayscale image is generated according to the different rows of pixels, and the generated grayscale image is used as the encoded image.

4. The method according to claim 2, characterized in that: The step of using the normalized first time series data and the second time series data as row features of a grayscale image respectively, and using the generated grayscale image as the encoded image, comprises: Determine whether the size of the row features corresponding to the normalized first time series data and the second time series data meets the preset image size requirements. If not, a grayscale image consisting of multiple rows of row features that meet the preset image size requirements is obtained by multiple copies of the row features corresponding to the normalized first time series data and the second time series data.

5. The method according to any one of claims 1 to 4, characterized in that: The historical comparison time period includes a first preset time range before the historical moment corresponding to the alarm triggering moment and a second preset time range after the historical moment.

6. The method according to claim 5, characterized in that Before the image encoding is performed by combining the first time series data and the second time series data, the method further includes: The first time series data and the second time series data are aligned, and empty data are filled in the part where the first time series data and the second time series data cannot be aligned, so that the padded first time series data can be aligned one-to-one with the second time series data.

7. The method according to any one of claims 1 to 4, characterized in that: The preset image model includes an encoder and a fully connected classifier; accordingly, predicting whether the monitoring indicator can automatically return to normal after the alarm is triggered by the preset image model includes: Extracting an image feature vector from the encoded image through an encoder of the preset image model; Through the fully connected classifier of the preset image model, the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered is determined according to the image feature vector, and the prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered is obtained according to the probability value.

8. The method according to claim 7, characterized in that The fully connected classifier of the preset image model determines the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered according to the image feature vector, including: Performing dimensionality reduction on the image feature vector through a fully connected layer of the fully connected classifier; Performing a nonlinear transformation on the image feature vector after dimensionality reduction by using the activation function of the fully connected classifier; The nonlinear transformation result is mapped into a probability value through the output layer of the fully connected classifier, which serves as the probability value of the monitoring indicator automatically returning to normal after the alarm is triggered.

9. The method according to claim 1, characterized in that: The method further comprises: Acquire a plurality of training data, wherein each training data includes a pre-acquired coded image and a preset label indicating whether the corresponding monitoring indicator can automatically return to normal after an alarm is triggered; According to the training data and the preset loss function, a preset optimization algorithm is used to optimize the parameters of the preset image model.

10. A system abnormality alarm device, characterized in that: include: An acquisition unit, configured to, in response to an abnormal alarm of a monitoring indicator, acquire first time series data of the monitoring indicator within a first preset time range before the alarm triggering moment, and second time series data of the monitoring indicator within a historical comparison time period, wherein the historical comparison time period is a historical time period corresponding to the first preset time range before the alarm triggering moment; an encoding unit, configured to perform image encoding on the first time series data and the second time series data to generate an encoded image; A prediction unit, configured to call a preset image model according to the coded image, and predict whether the monitoring indicator can automatically return to normal after the alarm is triggered by the preset image model; wherein the preset image model is used to output a prediction result of whether the monitoring indicator can automatically return to normal after the alarm is triggered according to the input coded image; The output unit is used to output an abnormal alarm message if it is predicted that the monitoring indicator cannot automatically return to normal after the alarm is triggered; or to stop outputting the abnormal alarm message if it is predicted that the monitoring indicator can automatically return to normal after the alarm is triggered.

11. An electronic device, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the method according to any one of claims 1 to 9 is implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images