Alarm storm suppression method, device, equipment and medium based on tree structure

Abstract

The present application relates to a method, device, equipment and medium for suppressing an alarm storm based on a tree structure, wherein the method comprises: generating an alarm information sample set according to the number of topological nodes of the tree structure, and generating a suppression result sample set corresponding to the alarm information sample set; training an alarm suppression prediction model based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; extracting database information, performing alarm suppression prediction processing on the database information through the target alarm suppression prediction model to generate target suppression information; performing alarm suppression processing according to the target suppression information. The present application improves the accuracy of alarm interception judgment, and is conducive to improving the accuracy of alarm storm suppression.

Description

Technical Field

[0001] The present application relates to the field of alarm monitoring technology, and in particular to a tree-structured alarm storm suppression method, device, equipment and medium. Background Art

[0002] In the operation and maintenance scenario of monitoring digital services, the system needs to be able to automatically identify abnormal situations and issue alarms. For the massive multi-dimensional and multi-indicator data generated in real time during the monitoring process, the system can spontaneously detect the abnormality of specific indicators according to needs and trigger alarms. However, in the operation of monitoring alarms, there is a problem of the blowout of "alarm storms". The main reason is that the various types of system services and related indicators being monitored are often nested with each other, and the abnormal operation of the upstream leads to abnormal operation of the downstream or related operations and triggers collective alarms. For example, "[parent] physical machine [child] virtual machine (a physical machine can run multiple virtual machines) [grandchild] various functions / services (each virtual machine can install a single multiple services)" have a nested relationship. The abnormal alarm of the parent function also leads to the abnormal alarm of the child cluster plus the grandchild cluster, thereby triggering and generating an "alarm storm" - that is, a large amount of alarm data is suddenly and continuously generated. As a result, it not only brings huge interference to the investigation of the cause of the problem, but also may cause the abnormal operation of the monitoring system. Therefore, it is necessary to further automatically investigate and process the alarm information on the basis that the system can monitor indicators and generate alarms. For example, it can locate the triggering source of the "alarm storm" and suppress other derivative alarms, so that the operation and maintenance system can maintain efficient operation and be able to promptly troubleshoot / solve problems.

[0003] Existing statistical and machine learning solutions have certain limitations for problems such as nested alarms and derived alarm storms. For example, manual specification, alarm deduplication, alarm classification, and alarm compression are statically specified fixed rules. Although they can reduce duplicate redundant alarms and filter priorities to a certain extent, they cannot identify and handle situations where associated nesting is suppressed. Similarly, NLP similarity aggregation identification filters out abnormal and rare information, and unsupervised learning alarm aggregation marks unconventional information through time and space aggregation. These two methods are also unable to identify and handle associated nesting situations. In addition, although traditional root cause location and knowledge graphs may identify nested relationships to a certain extent, model training requires screening, marking time series, topological relationships, etc. for massive amounts of historical data. Modeling is complex, tedious, and time-consuming, and it cannot cover nested situations beyond historical situations, resulting in low accuracy in suppressing alarm storms. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose a tree-structured alarm storm suppression method, apparatus, device and medium to improve the accuracy of alarm interception judgment, thereby improving the accuracy of alarm storm suppression.

[0005] In order to solve the above technical problems, the embodiment of the present application provides an alarm storm suppression method based on a tree structure, comprising:

[0006] Generate an alarm information sample set according to the number of topological nodes of the tree structure, and generate a suppression result sample set corresponding to the alarm information sample set;

[0007] Training an alarm suppression prediction model based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model;

[0008] Extracting database information, performing alarm suppression prediction processing on the database information through the target alarm suppression prediction model, and generating target suppression information;

[0009] Perform alarm suppression processing according to the target suppression information.

[0010] In order to solve the above technical problems, the embodiment of the present application provides an alarm storm suppression device based on a tree structure, comprising:

[0011] A sample set generating unit, configured to generate an alarm information sample set according to the number of topological nodes of the tree structure, and generate a suppression result sample set corresponding to the alarm information sample set;

[0012] A model training unit, used to train an alarm suppression prediction model based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model;

[0013] A suppression prediction unit, used to extract database information, perform alarm suppression prediction processing on the database information through the target alarm suppression prediction model, and generate target suppression information;

[0014] A suppression processing unit is used to perform alarm suppression processing according to the target suppression information.

[0015] To solve the above technical problems, a technical solution adopted by the present invention is: to provide a computer device, including one or more processors; a memory for storing one or more programs, so that the one or more processors implement any one of the tree-structured alarm storm suppression methods described above.

[0016] To solve the above technical problems, a technical solution adopted by the present invention is: a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, any one of the above-mentioned tree-structured alarm storm suppression methods is implemented.

[0017] The embodiment of the present invention provides a method, device, equipment and medium for suppressing an alarm storm based on a tree structure. The method includes: generating an alarm information sample set according to the number of topological nodes of the tree structure, and generating a suppression result sample set corresponding to the alarm information sample set; training an alarm suppression prediction model based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; extracting database information, performing alarm suppression prediction processing on the database information through the target alarm suppression prediction model to generate target suppression information; performing alarm suppression processing according to the target suppression information. The embodiment of the present invention generates an alarm information sample set and a suppression result sample set through the number of topological nodes of the tree, and trains the alarm suppression prediction model through the alarm information sample set and the suppression result sample set, so that the alarm interception judgment is performed through the tree structure data, and a high-precision nested relationship can be identified, which is conducive to improving the accuracy of the alarm interception judgment, and then improving the accuracy of the alarm storm suppression. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 It is a flowchart of the implementation process of the tree structure-based alarm storm suppression method provided in an embodiment of the present application;

[0020] Figure 2 It is a schematic diagram of generating a modeling feature set provided in an embodiment of the present application;

[0021] Figure 3 It is a flowchart for implementing the first sub-process in the tree structure-based alarm storm suppression method provided in an embodiment of the present application;

[0022] Figure 4 It is a flowchart for implementing the second sub-process in the tree structure-based alarm storm suppression method provided in an embodiment of the present application;

[0023] Figure 5 It is a flowchart for implementing the third sub-process in the tree structure-based alarm storm suppression method provided in an embodiment of the present application;

[0024] Figure 6 It is a flowchart for implementing the fourth sub-process in the tree structure-based alarm storm suppression method provided in an embodiment of the present application;

[0025] Figure 7It is a flowchart for implementing the fifth sub-process in the tree structure-based alarm storm suppression method provided in an embodiment of the present application;

[0026] Figure 8 It is a flowchart for implementing the sixth sub-process in the tree structure-based alarm storm suppression method provided in an embodiment of the present application;

[0027] Fig. 9 It is a schematic diagram of an alarm storm suppression device based on a tree structure provided in an embodiment of the present application;

[0028] Fig.10 It is a schematic diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0030] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0031] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0032] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0033] It should be noted that the tree-structure-based alarm storm suppression method provided in the embodiment of the present application is generally executed by a server, and accordingly, the tree-structure-based alarm storm suppression device is generally configured in the server.

[0034] The embodiment of the present application monitors the hardware, virtual machines, software and other resources of different users in real time, and ensures the stability and efficient operation of resources through the real-time feedback of each resource dimension parameter index in unit time. Therefore, a feature of the monitoring system is that it needs to receive and interpret and process massive data streams in real time. Among them, when receiving the monitoring data index in real time, it is necessary to analyze the operation status of different resource services, and generate alarms in time when there are problems, so that the operation and maintenance personnel can deal with the problems of the resource system in time. Because the system resource indicators are nested with each other, sporadic anomalies may induce group anomalies and corresponding alarms. A large number of alarms are poured in per unit time, which brings great difficulties and affects the business for the operation and maintenance personnel to investigate and handle. At the same time, the back-end system pours in massive interference information in real time, which may cause abnormal operation of the system. For this reason, the embodiment of the present application is intended to identify and intercept derivative alarms, avoid introducing a large number of alarms at the same time, and make it difficult to eliminate the cause of the alarm.

[0035] See also Figure 1 and Figure 2 , Figure 1 A specific implementation of the tree-structure-based alarm storm suppression method is shown. Figure 2 This is a schematic diagram of generating a modeling feature set provided in an embodiment of the present application.

[0036] It should be noted that if there are substantially the same results, the method of the present invention is not limited to Figure 1 The process sequence shown is limited to the following steps:

[0037] S1: Generate an alarm information sample set according to the number of topological nodes of the tree structure, and generate a suppression result sample set corresponding to the alarm information sample set.

[0038] like Figure 2 As shown in FIG. 1 , a tree structure is constructed based on virtual machine alarms, Kafka alarms, memory alarms, MySQL alarms, and CPU alarms, and an alarm information sample set is generated based on the topological nodes of the tree structure. Each feature value in each row of the alarm information sample indicates that an alarm has occurred or not. In one embodiment, Figure 2 As shown, if the alarm information sample is [1, 1, 0, 1, 1], virtual machine alarms, CPU alarms, Kafka alarms, and MySQL alarms appear, but no memory alarms appear. After generating the alarm information sample set, for each row of alarm information samples, a suppression result sample corresponding to the alarm information sample is generated based on the preset suppression rule. When all samples are generated, a suppression result sample set is obtained. For example, if the suppression result sample generated corresponding to the alarm information sample [1, 1, 0, 1, 1] is [0, 1, 0, 1, 1], the CPU alarm, Kafka alarm, and MySQL alarm are suppressed, while the virtual machine alarm and memory alarm are not suppressed.

[0039] See also Figure 3 , Figure 3 A specific implementation of step S1 is shown, which is described in detail as follows:

[0040] S11: Generate an alarm information sample according to the number of topological nodes of the tree structure.

[0041] S12: Performing sample generation processing on the alarm information samples according to a preset sample replication amount to generate the alarm information sample set.

[0042] S13: Generate a suppression result sample for each row of alarm information samples in the alarm information sample set according to a preset suppression rule to obtain the suppression result sample set.

[0043] Specifically, when constructing a tree structure, a root node needs to be constructed. If there are multiple root nodes in the topological concept tree, a root node can be virtualized, and the root node of the alarm system is defined as a child node of the virtual root node. Among them, the root node is the alarm type set according to the actual situation, which can be any of virtual machine alarms, Kafka alarms, memory alarms, MySQL alarms and CPU alarms. Generate alarm information samples according to the number of topological nodes in the tree structure, perform sample generation processing on the alarm information samples according to the preset sample replication amount, and generate an alarm information sample set. The sample size of the alarm information sample set is: (2^k)*m, k is the number of nodes of the tree result; m>=1, which is the sample replication amount. In the process of model training, the training sample set is increased by replicating training samples, and the model can further improve the prediction accuracy when there are more sample learning.

[0044] Furthermore, since some models (such as logistic regression) cannot accept columns with all zeros in the root node (because the root node will never be suppressed), they need to be deleted when modeling. Therefore, it is necessary to mark the root node column in the tree structure to facilitate the regression root node prediction when using these models.

[0045] See also Figure 4 , Figure 4 A specific implementation of step S13 is shown, which is described in detail as follows:

[0046] S131: traverse each row of alarm information samples in the alarm information sample set in sequence.

[0047] S132: If there is a parent node alarm in the alarm information sample, a suppression result sample for suppressing and intercepting all downstream node alarms is generated.

[0048] S133: If the alarm information sample includes a virtual machine alarm, a Kafka alarm, and a memory alarm, a suppression result sample for suppressing the Kafka alarm and the memory alarm is generated.

[0049] S134: If the memory alarm and the MySQL alarm exist in the alarm information sample at the same time, a suppression result sample for suppressing the MySQL alarm and the Kafka alarm is generated.

[0050] S135: If the memory alarm and the CPU alarm exist in the alarm information sample at the same time, a suppression result sample in which the alarm is not suppressed is generated.

[0051] S136: When the suppression result samples corresponding to all the alarm information samples are generated, the suppression result sample set is obtained.

[0052] Specifically, after generating the alarm information sample set, traverse each alarm information sample in the alarm information sample set. If there is a parent node alarm in the alarm information sample within a single time, a suppression result sample that suppresses and intercepts all downstream node alarms is generated. If there are virtual machine alarms, Kafka alarms and memory alarms in the alarm information sample at the same time within a single time, a suppression result sample that suppresses Kafka alarms and memory alarms is generated. If there are memory alarms and MySQL alarms in the alarm information sample at the same time within a single time, a suppression result sample that suppresses MySQL alarms and Kafka alarms is generated. If there are memory alarms and CPU alarms in the alarm information sample at the same time within a single time, a suppression result sample that does not suppress the alarm is generated. When the suppression result samples corresponding to all the alarm information samples are generated, a suppression result sample set is obtained.

[0053] S2: Training an alarm suppression prediction model based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model.

[0054] Specifically, training data and test data are constructed through the alarm information sample set and the suppression result sample set, and then the alarm suppression prediction model is trained and tested through the training data and the test data to obtain the target alarm suppression prediction model. In the application embodiment, the alarm suppression prediction model can be any one of a logistic regression algorithm model, a random forest algorithm model, and a deep neural network model.

[0055] See also Figure 5 , Figure 5 A specific implementation of step S2 is shown, which is described in detail as follows:

[0056] S21: constructing training data and test data according to the warning information sample set and the suppression result sample set.

[0057] See also Figure 6 , Figure 6 A specific implementation of step S21 is shown, which is described in detail as follows:

[0058] S211: Randomly shuffle the alarm information sample set and the suppression result sample set to obtain shuffled samples.

[0059] S212: Divide the shuffled sample set into the training data and the test data according to a preset ratio, wherein the training data and the test data both include warning information samples and suppression result samples.

[0060] Specifically, in order to increase the sample size of the training model so that the model has more samples to learn, the scale factor can be set to >= 2, and the sample set can be multiplied (the existing alarm information sample set and suppression result sample set can also be retained). After the multiplication and copying, all alarm information sample sets and suppression result sample sets are randomly shuffled to obtain shuffled samples. The shuffled sample set is divided into training data and test data according to a preset ratio, wherein the training data and the test data both include alarm information samples and suppression result samples.

[0061] It should be noted that the preset ratio is set according to actual conditions and is not limited here. In a specific embodiment, the sample set consisting of the alarm information sample set and the suppression result sample set is divided into training data and test data according to a ratio of 8:2.

[0062] S22: Inputting the training data into the alarm suppression prediction model to perform model training, and obtaining a trained alarm suppression prediction model.

[0063] See also Figure 7 , Figure 7 A specific implementation of step S22 is shown, which is described in detail as follows:

[0064] S221: Input the training data into the alarm suppression prediction model to convert the training data into preset dimension data to obtain target training data.

[0065] S222: extracting various types of indicator features from the target training data, and grouping the various types of indicator features to obtain grouping features.

[0066] S223: Perform classification mapping according to the grouping features to obtain a suppression result, and calculate prediction accuracy based on the suppression result and the suppression result samples in the target training data.

[0067] S224: If the prediction accuracy does not reach the preset threshold, the model parameters of the alarm suppression prediction model are adjusted, and the adjusted alarm suppression prediction model is iteratively trained again based on the training data until the prediction accuracy reaches the preset threshold, thereby obtaining the trained alarm suppression prediction model.

[0068] Specifically, in the alarm suppression prediction model, there are multiple inputs and multiple outputs, and the multiple inputs are inputs of multiple alarm information data, and the multiple outputs are outputs of multiple alarm suppression results corresponding to the inputs. In an embodiment of the present application, if the alarm suppression prediction model is a deep neural algorithm network model, it is necessary to convert the training data into preset dimensional data to obtain target training data. For example, the format of the alarm information samples in the training data is converted from two dimensions to three dimensions, that is, [sample size x number of dictionary nodes] is converted to [sample size x number of dictionary nodes x 1], and the sample size is the alarm information sample in the training data. Some two-dimensional convolutional neural networks need to be converted to four dimensions, and then one dimension is added to the three dimensions.

[0069] When training the model, it is necessary to extract various indicator features within each unit time, and then group the various indicator features to obtain group features. Classification mapping is performed based on the group features to obtain the suppression result, and the prediction accuracy is calculated based on the suppression result and the suppression result samples in the target training data. If the prediction accuracy does not reach the preset threshold, the model parameters of the alarm suppression prediction model are adjusted, and the adjusted alarm suppression prediction model is iteratively trained again based on the training data until the prediction accuracy reaches the preset threshold, and the trained alarm suppression prediction model is obtained.

[0070] S23: Testing and verifying the trained alarm suppression prediction model using the test data to obtain the target suppression prediction model.

[0071] Specifically, after the alarm suppression prediction model has been trained in the above steps, the trained alarm suppression prediction model is tested and verified by the test data. During the model test, the trained alarm suppression prediction model is used to predict the alarm information samples in the test data to obtain the alarm suppression prediction results of the multi-variable output, and then the prediction accuracy is calculated based on the alarm suppression samples in the test data and the alarm suppression prediction results, and the prediction accuracy is tested and verified to obtain the target suppression prediction model.

[0072] S3: extracting database information, performing alarm suppression prediction processing on the database information through the target alarm suppression prediction model, and generating target suppression information.

[0073] Specifically, information is extracted from a database of alarm data in real time to obtain database information, which includes information on alarm types. The database information is processed for alarm suppression prediction using a target alarm suppression prediction model to generate target suppression information.

[0074] See also Figure 8 , Figure 8 A specific implementation of step S3 is shown, which is described in detail as follows:

[0075] S31: extracting the database information corresponding to the alarm from the database in real time.

[0076] S32: Generate target warning information based on the database information.

[0077] S33: Performing alarm suppression prediction processing based on the target alarm information through the target alarm suppression prediction model to generate the target suppression information.

[0078] Specifically, in the actual alarm monitoring scenario, it is necessary to extract the database information corresponding to the alarm from the database in real time, and the database information includes data corresponding to virtual machine alarms, Kafka alarms, memory alarms, MySQL alarms, and CPU alarms. Then, the target alarm information is obtained according to the alarm situation corresponding to the database information. Among them, the target alarm information includes whether virtual machine alarms, Kafka alarms, memory alarms, MySQL alarms, and CPU alarms occur. Finally, the target alarm suppression prediction model is used to perform alarm suppression prediction processing based on the target alarm information to generate target suppression information.

[0079] S4: Perform alarm suppression processing according to the target suppression information.

[0080] Specifically, the target suppression information includes alarms that need to be suppressed and alarms that do not need to be suppressed, so the alarms that need to be suppressed are suppressed to avoid a large number of alarms being integrated into the alarm monitoring system at the same time, which makes it difficult to eliminate the causes of the alarms and cannot process the alarm information in time.

[0081] In an embodiment of the present application, an alarm information sample set is generated according to the number of topological nodes of a tree structure, and a suppression result sample set corresponding to the alarm information sample set is generated; an alarm suppression prediction model is trained based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; database information is extracted, and the database information is subjected to alarm suppression prediction processing through the target alarm suppression prediction model to generate target suppression information; and alarm suppression processing is performed according to the target suppression information. An embodiment of the present invention generates an alarm information sample set and a suppression result sample set through the number of topological nodes of a tree structure, and trains an alarm suppression prediction model through the alarm information sample set and the suppression result sample set, so that alarm interception judgment is performed through tree-structured data, and high-precision nested relationships can be identified, which is conducive to improving the accuracy of alarm interception judgment, and further improving the accuracy of alarm storm suppression.

[0082] In the embodiment of the present application, the alarm suppression prediction can be accurately performed through the prediction method of multi-variable input and multi-variable output. At the same time, the embodiment of the present application does not require massive historical data processing marks, and generates data through a tree structure, avoiding massive data processing and data redundancy. And different trained alarm suppression prediction models can be connected and used at the same time, and their independent use does not affect conflicts, which brings a lot of flexibility to the system. The embodiment of the present application solves the alarm blowout phenomenon and even alarm storm caused by the nested association of alarm resources, can effectively identify the root cause of the problem of nested associations and mark to help intercept derived redundant alarms, and can help maintain the normal operation of the alarm system.

[0083] Please refer to Fig. 9 , as a response to the above Figure 1 The present application provides an embodiment of an alarm storm suppression device based on a tree structure. Figure 1 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0084] like Fig. 9 As shown, the tree-structured alarm storm suppression device of this embodiment includes: a sample set generation unit 51, a model training unit 52, a suppression prediction unit 53 and a suppression processing unit 54, wherein:

[0085] A sample set generating unit 51, configured to generate an alarm information sample set according to the number of topological nodes of the tree structure, and generate a suppression result sample set corresponding to the alarm information sample set;

[0086] A model training unit 52, configured to train an alarm suppression prediction model based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model;

[0087] The suppression prediction unit 53 is used to extract database information, perform alarm suppression prediction processing on the database information through the target alarm suppression prediction model, and generate target suppression information;

[0088] The suppression processing unit 54 is used to perform alarm suppression processing according to the target suppression information.

[0089] Furthermore, the sample set generating unit 51 includes:

[0090] An alarm information sample generating unit, used to generate an alarm information sample according to the number of topological nodes of the tree structure;

[0091] An alarm information sample set generating unit, configured to perform sample generation processing on the alarm information samples according to a preset sample replication amount to generate the alarm information sample set;

[0092] The suppression result sample set generating unit is used to generate a suppression result sample for each row of alarm information samples in the alarm information sample set according to a preset suppression rule to obtain the suppression result sample set.

[0093] Furthermore, the suppression result sample set generating unit is used to include:

[0094] An alarm information sample traversal unit, used for traversing each row of alarm information samples in the alarm information sample set in sequence;

[0095] A first suppression result sample unit, configured to generate a suppression result sample for suppressing and intercepting all downstream node alarms if a parent node alarm exists in the alarm information sample;

[0096] The second suppression result sample unit is used to generate a suppression result sample for suppressing the Kafka alarm and the memory alarm if the virtual machine alarm, the Kafka alarm and the memory alarm exist in the alarm information sample at the same time;

[0097] A third suppression result sample unit, configured to generate a suppression result sample for suppressing the MySQL alarm and the Kafka alarm if the memory alarm and the MySQL alarm exist in the alarm information sample at the same time;

[0098] a fourth suppression result sample unit, configured to generate a suppression result sample of not suppressing the alarm if the memory alarm and the CPU alarm exist in the alarm information sample at the same time;

[0099] The sample set generating unit is used to obtain the suppression result sample set when the suppression result samples corresponding to all the alarm information samples are generated.

[0100] Furthermore, the model training unit 52 includes:

[0101] A training data construction unit, used to construct training data and test data according to the warning information sample set and the suppression result sample set;

[0102] An alarm suppression prediction model training unit is used to input the training data into the alarm suppression prediction model to perform model training to obtain a trained alarm suppression prediction model;

[0103] A model testing unit is used to test and verify the trained alarm suppression prediction model through the test data to obtain the target suppression prediction model.

[0104] Furthermore, the training data construction unit includes:

[0105] A data scrambling unit, used for randomly scrambling the alarm information sample set and the suppression result sample set to obtain a scrambled sample set;

[0106] A data division unit is used to divide the shuffled sample set into the training data and the test data according to a preset ratio, wherein the training data and the test data both include warning information samples and suppression result samples.

[0107] Furthermore, the alarm suppression prediction model training unit includes:

[0108] A data conversion unit, used for inputting the training data into the alarm suppression prediction model to convert the training data into preset dimension data to obtain target training data;

[0109] An indicator feature extraction unit, used to extract various indicator features in the target training data, and perform feature grouping on each of the indicator features to obtain grouping features;

[0110] A prediction accuracy calculation unit, configured to perform classification mapping according to the grouping features to obtain a suppression result, and calculate the prediction accuracy based on the suppression result and a suppression result sample in the target training data;

[0111] An iterative training unit is used to adjust the model parameters of the alarm suppression prediction model if the prediction accuracy does not reach a preset threshold, and re-iteratively train the adjusted alarm suppression prediction model based on the training data until the prediction accuracy reaches the preset threshold, thereby obtaining the trained alarm suppression prediction model.

[0112] Further, the suppression prediction unit 53 includes:

[0113] A database information extraction unit, used to extract the database information corresponding to the alarm from the database in real time;

[0114] A target warning information generating unit, configured to generate target warning information based on the database information;

[0115] The target suppression information generating unit is used to perform warning suppression prediction processing based on the target warning information through the target warning suppression prediction model to generate the target suppression information.

[0116] In an embodiment of the present application, an alarm information sample set is generated according to the number of topological nodes of a tree structure, and a suppression result sample set corresponding to the alarm information sample set is generated; an alarm suppression prediction model is trained based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; database information is extracted, and the database information is subjected to alarm suppression prediction processing through the target alarm suppression prediction model to generate target suppression information; and alarm suppression processing is performed according to the target suppression information. An embodiment of the present invention generates an alarm information sample set and a suppression result sample set through the number of topological nodes of a tree structure, and trains an alarm suppression prediction model through the alarm information sample set and the suppression result sample set, so that alarm interception judgment is performed through tree-structured data, and high-precision nested relationships can be identified, which is conducive to improving the accuracy of alarm interception judgment, and further improving the accuracy of alarm storm suppression.

[0117] To solve the above technical problems, the present application also provides a computer device. Fig.10 , Fig.10 This is a basic structural block diagram of the computer device in this embodiment.

[0118] The computer device 6 includes a memory 61, a processor 62, and a network interface 63 which are interconnected through a system bus. It should be noted that: Fig.10 Only a computer device 6 having three components, a memory 61, a processor 62, and a network interface 63, is shown in the figure, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0119] Computer devices can be computing devices such as desktop computers, notebooks, PDAs, and cloud servers. Computer devices can interact with users through keyboards, mice, remote controls, touch pads, or voice control devices.

[0120] The memory 61 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 61 can be an internal storage unit of the computer device 6, such as a hard disk or memory of the computer device 6. In other embodiments, the memory 61 can also be an external storage device of the computer device 6, such as a plug-in hard disk equipped on the computer device 6, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 61 can also include both the internal storage unit of the computer device 6 and its external storage device. In this embodiment, the memory 61 is generally used to store the operating system and various application software installed on the computer device 6, such as the program code of the alarm storm suppression method based on the tree structure, etc. In addition, the memory 61 can also be used to temporarily store various types of data that have been output or are to be output.

[0121] The processor 62 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 62 is generally used to control the overall operation of the computer device 6. In this embodiment, the processor 62 is used to run the program code stored in the memory 61 or process data, such as running the program code of the above-mentioned tree-structure-based alarm storm suppression method to implement various embodiments of the tree-structure-based alarm storm suppression method.

[0122] The network interface 63 may include a wireless network interface or a wired network interface, and the network interface 63 is generally used to establish a communication connection between the computer device 6 and other electronic devices.

[0123] The present application also provides another implementation, namely, providing a computer-readable storage medium, which stores a computer program, and the computer program can be executed by at least one processor to enable the at least one processor to perform the steps of the above-mentioned tree-structured alarm storm suppression method.

[0124] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0125] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to replace some of the technical features therein with equivalents. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A method for suppressing an alarm storm based on a tree structure, characterized in that: include: Generate an alarm information sample set according to the number of topological nodes of the tree structure, and generate a suppression result sample set corresponding to the alarm information sample set; Training an alarm suppression prediction model based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; Extracting database information, performing alarm suppression prediction processing on the database information through the target alarm suppression prediction model, and generating target suppression information; Perform alarm suppression processing according to the target suppression information.

2. The method for suppressing an alarm storm based on a tree structure according to claim 1, characterized in that: The generating of the alarm information sample set according to the number of topological nodes of the tree structure, and generating the suppression result sample set corresponding to the alarm information sample set, comprises: Generate an alarm information sample according to the number of topological nodes of the tree structure; Performing sample generation processing on the alarm information sample according to a preset sample replication amount to generate the alarm information sample set; Each row of alarm information samples in the alarm information sample set is used to generate a suppression result sample according to a preset suppression rule to obtain the suppression result sample set.

3. The tree-structure-based alarm storm suppression method according to claim 2 is characterized in that: The step of generating a suppression result sample according to a preset suppression rule for each row of the alarm information sample in the alarm information sample set to obtain the suppression result sample set includes: Traversing each row of alarm information samples in the alarm information sample set in sequence; If there is a parent node alarm in the alarm information sample, generating a suppression result sample for suppressing and intercepting all downstream node alarms; If the alarm information sample contains a virtual machine alarm, a Kafka alarm, and a memory alarm at the same time, a suppression result sample for suppressing the Kafka alarm and the memory alarm is generated; If the memory alarm and the MySQL alarm exist in the alarm information sample at the same time, a suppression result sample for suppressing the MySQL alarm and the Kafka alarm is generated; If the memory alarm and the CPU alarm exist in the alarm information sample at the same time, a suppression result sample in which the alarm is not suppressed is generated; When the suppression result samples corresponding to all the warning information samples are generated, the suppression result sample set is obtained.

4. The method for suppressing an alarm storm based on a tree structure according to claim 1, characterized in that: The training of the alarm suppression prediction model based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model includes: Constructing training data and test data according to the warning information sample set and the suppression result sample set; Inputting the training data into the alarm suppression prediction model for model training to obtain a trained alarm suppression prediction model; The trained alarm suppression prediction model is tested and verified by using the test data to obtain the target suppression prediction model.

5. The tree-structure-based alarm storm suppression method according to claim 4 is characterized in that: The constructing of training data and test data according to the warning information sample set and the suppression result sample set includes: Randomly shuffle the warning information sample set and the suppression result sample set to obtain a shuffled sample set; The shuffled sample set is divided into the training data and the test data according to a preset ratio, wherein the training data and the test data both include warning information samples and suppression result samples.

6. The tree-structure-based alarm storm suppression method according to claim 4, characterized in that: The step of inputting the training data into the alarm suppression prediction model for model training to obtain a trained alarm suppression prediction model includes: Inputting the training data into the alarm suppression prediction model to convert the training data into preset dimension data to obtain target training data; Extracting various indicator features from the target training data, and grouping the various indicator features to obtain grouping features; Performing classification mapping according to the grouping features to obtain an inhibition result, and calculating a prediction accuracy based on the inhibition result and an inhibition result sample in the target training data; If the prediction accuracy does not reach the preset threshold, the model parameters of the alarm suppression prediction model are adjusted, and the adjusted alarm suppression prediction model is iteratively trained again based on the training data until the prediction accuracy reaches the preset threshold, thereby obtaining the trained alarm suppression prediction model.

7. The method for suppressing an alarm storm based on a tree structure according to any one of claims 1 to 6, characterized in that: The extracting database information, performing alarm suppression prediction processing on the database information through the target alarm suppression prediction model, and generating target suppression information includes: Extracting the database information corresponding to the alarm from the database in real time; generating target warning information based on the database information; The target suppression information is generated by performing an alarm suppression prediction process based on the target alarm information through the target alarm suppression prediction model.

8. An alarm storm suppression device based on a tree structure, characterized in that: include: A sample set generating unit, configured to generate an alarm information sample set according to the number of topological nodes of the tree structure, and generate a suppression result sample set corresponding to the alarm information sample set; A model training unit, used to train an alarm suppression prediction model based on the alarm information sample set and the suppression result sample set to obtain a target alarm suppression prediction model; A suppression prediction unit, used to extract database information, perform alarm suppression prediction processing on the database information through the target alarm suppression prediction model, and generate target suppression information; A suppression processing unit is used to perform alarm suppression processing according to the target suppression information.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the method for suppressing an alarm storm based on a tree structure as claimed in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the tree-structured alarm storm suppression method according to any one of claims 1 to 7 is implemented.

Images