Fault alarm management method and device

Abstract

The invention discloses a fault alarm management method and device. The method comprises the following steps: acquiring a plurality of pieces of alarm data in a target time period, and determining feature vectors related to space and fault professional dimensions and corresponding to each piece of alarm data; calculating a first text similarity emphasizing on a spatial dimension and a second text similarity emphasizing on a fault professional dimension between every two pieces of alarm data according to the feature vectors; clustering all the alarm data based on the first text similarity to obtain a plurality of clusters, determining the cluster with the number of the alarm data exceeding a first threshold as a first target cluster, and generating regional large-scale alarm prompt information; and clustering the alarm data in the first target cluster based on the second text similarity to obtain a plurality of clusters, determining the cluster with the number of the alarm data exceeding a second threshold as a second target cluster, and generating single-specialty large-scale alarm prompt information. According to the invention, the technical problems that a related alarm processing scheme is difficult to accurately identify and merge large-scale alarm events and the processing efficiency is low are solved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a fault alarm management method and device. Background Art

[0002] With the rapid development of information technology, especially in key infrastructure fields such as communications and data centers, network operation and maintenance management has become a core element to ensure business continuity and stability. However, with the continuous expansion of system scale and the increase in complexity, the amount of alarm information generated by the monitoring system has increased dramatically. These alarm information not only contains a large number of duplicate alarms and false alarms, but also related alarms caused by the interdependence and influence between devices. The massive growth and complexity of alarm information have greatly increased the difficulty of fault diagnosis and location, making the operation and maintenance of network systems more complicated, bringing unprecedented challenges to the operation and maintenance team, and seriously affecting the efficiency of alarm processing. When a communication network encounters a large-scale alarm event, maintenance personnel are required to quickly investigate and locate the affected scope in a very short time. Therefore, it is crucial to accurately identify these large-scale alarm events from the massive communication network alarm data, which helps to quickly identify faults, accurately dispatch orders, and effectively merge work orders, thereby supporting the front-line team to efficiently perform daily operation and maintenance and fault repair tasks.

[0003] Traditional alarm merging and convergence methods often rely on manually defined rules and rule-based alarm aggregation. Although this method can reduce the occurrence of duplicate alarms and false alarms to a certain extent, its flexibility and scalability are limited, and it is difficult to cope with the increasingly complex alarm environment. Especially when the system scale is further expanded and the equipment types are more diversified, the rule-based method needs to be frequently updated and adjusted, which undoubtedly increases the complexity and cost of operation and maintenance.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a fault alarm management method and device to at least solve the technical problem that related alarm processing schemes are difficult to accurately identify and merge large-scale alarm events and have low processing efficiency.

[0006] According to one aspect of an embodiment of the present application, a fault alarm management method is provided, comprising: obtaining multiple alarm data within a target time period, and determining feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension; determining a first text similarity and a second text similarity between each two alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension; performing agglomerative hierarchical clustering on the multiple alarm data based on the first text similarity to obtain multiple first clusters, and determining a first cluster including alarm data whose number exceeds a first preset threshold as a first target cluster, and generating regional large-scale alarm event prompt information based on the first target cluster; for each first target cluster, performing agglomerative hierarchical clustering on the multiple alarm data in the first target cluster based on the second text similarity to obtain multiple second clusters, and determining a second cluster including alarm data whose number exceeds a second preset threshold as a second target cluster, and generating single-professional large-scale alarm event prompt information based on the second target cluster.

[0007] Optionally, obtaining multiple alarm data within a target time period includes: using a sliding time window to determine a time window of a historical time period including the current moment and a preset time period before the current moment as the target time period, and obtaining multiple alarm data within the target time period.

[0008] Optionally, determining feature vectors of multiple dimensions corresponding to each alarm data includes: for each alarm data, determining target fields of multiple dimensions in the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension, the spatial dimension includes at least one of the following: an alarm area dimension, an alarm sub-area dimension under the alarm area, and the fault professional dimension includes at least one of the following: an alarm name dimension, an alarm device name dimension, and an alarm device location information dimension; for each dimension, using a pre-trained word vector model to determine the word embedding vector corresponding to the target field of the dimension, and counting the word frequency and inverse document frequency corresponding to the target field of the dimension, and taking the product of the word frequency, inverse document frequency and word embedding vector as the feature vector of the dimension.

[0009] Optionally, the first text similarity and the second text similarity between every two alarm data are determined based on the feature vectors of multiple dimensions and the weights corresponding to each dimension, including: for every two alarm data, respectively determining the cosine similarity between the two feature vectors corresponding to the two alarm data in each dimension; obtaining a preset first weight mapping relationship and a second weight mapping relationship, wherein, in the first weight mapping relationship, the weight corresponding to the feature vector of the spatial dimension is greater than the weight corresponding to the feature vector of the fault professional dimension, and in the second weight mapping relationship, the weight corresponding to the feature vector of the fault professional dimension is greater than the weight corresponding to the feature vector of the spatial dimension; performing weighted summation of the cosine similarities in multiple dimensions according to the first weight mapping relationship to obtain the first text similarity between the two alarm data; performing weighted summation of the cosine similarities in multiple dimensions according to the second weight mapping relationship to obtain the second text similarity between the two alarm data.

[0010] Optionally, after determining the first text similarity and the second text similarity between every two alarm data based on the feature vectors of multiple dimensions and the weights corresponding to each dimension, the method also includes: for every two alarm data, determining the difference between 1 and the first text similarity between the two alarm data as the first text distance between the two alarm data, and determining the difference between 1 and the second text similarity between the two alarm data as the second text distance between the two alarm data; constructing a first text distance matrix based on multiple first text distances, and constructing a second text distance matrix based on multiple second text distances.

[0011] Optionally, agglomerative hierarchical clustering is performed on multiple alarm data based on the first text similarity, including: treating each alarm data in the multiple alarm data as an independent cluster, and determining a first cluster distance matrix between the multiple independent clusters based on the first text distance matrix, wherein the first cluster distance between any two clusters is the first text distance between two alarm data corresponding to the two clusters; looping the following process until a preset termination condition is met: determining the minimum first cluster distance from the first cluster distance matrix, and if the first cluster distance is not greater than a preset first distance threshold, merging the two independent clusters corresponding to the minimum first cluster distance into a new cluster; updating the first cluster distance matrix based on the merging result, wherein the first cluster distance between the new cluster and any other independent cluster is the average of multiple first text distances between each alarm data in the new cluster and each alarm data in the other independent clusters; determining that the loop is terminated when the first cluster distances between any two clusters in the first cluster distance matrix are greater than the first distance threshold.

[0012] Optionally, agglomerative hierarchical clustering is performed on multiple alarm data in the first target cluster based on the second text similarity, including: taking each alarm data in the multiple alarm data in the first target cluster as an independent cluster, and determining a second cluster distance matrix between the multiple independent clusters based on the second text distance matrix, wherein the second cluster distance between any two clusters is the second text distance between two alarm data corresponding to the two clusters; looping the following process until a preset termination condition is met: determining the minimum second cluster distance from the second cluster distance matrix, and if the second cluster distance is not greater than a preset second distance threshold, merging the two independent clusters corresponding to the minimum second cluster distance into a new cluster; updating the second cluster distance matrix based on the merging result, wherein the second cluster distance between the new cluster and any other independent cluster is the average of multiple second text distances between each alarm data in the new cluster and each alarm data in the other independent clusters; and determining that the loop is terminated when the second cluster distances between any two clusters in the second cluster distance matrix are greater than the second distance threshold.

[0013] According to another aspect of an embodiment of the present application, a fault alarm management device is also provided, including: an acquisition module, used to acquire multiple alarm data within a target time period, and determine feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension; a similarity determination module, used to determine a first text similarity and a second text similarity between every two alarm data based on the feature vectors of multiple dimensions and the weights corresponding to each dimension, wherein, when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the fault professional dimension. The weight is greater than the weight of the feature vector of the spatial dimension; a first clustering module is used to perform agglomerative hierarchical clustering on multiple alarm data according to a first text similarity to obtain multiple first clusters, and determine that the first cluster including the number of alarm data exceeding the first preset threshold is the first target cluster, and generate regional large-scale alarm event prompt information according to the first target cluster; a second clustering module is used to perform agglomerative hierarchical clustering on multiple alarm data in the first target cluster according to the second text similarity for each first target cluster to obtain multiple second clusters, and determine that the second cluster including the number of alarm data exceeding the second preset threshold is the second target cluster, and generate single-professional large-scale alarm event prompt information according to the second target cluster.

[0014] According to another aspect of an embodiment of the present application, a computer program product is further provided, the computer program product comprising: a computer program, wherein when the computer program is executed by a processor, the above-mentioned fault alarm management method is implemented.

[0015] According to another aspect of an embodiment of the present application, an electronic device is further provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned fault alarm management method through the computer program.

[0016] In an embodiment of the present application, by extracting spatial dimension features (such as regions, sub-regions) and fault professional dimension features (such as alarm names, equipment names, and positioning information) of alarm data and calculating text similarity, the alarm data can be analyzed from a more comprehensive and detailed perspective. When calculating text similarity, by dynamically adjusting weights, key features can be highlighted in different scenarios. When calculating the first text similarity, the weight of the spatial dimension feature vector is set higher, which helps to quickly identify cross-professional alarm events that are geographically adjacent or in the same area. When calculating the second text similarity, the weight of the fault professional dimension feature vector is emphasized, which can more accurately merge alarms with similar properties in professional fields, such as large-scale equipment outages or system failures. In addition, the alarm data is clustered according to the first text similarity to obtain multiple first clusters. This step helps to identify large-scale, cross-professional alarm events. Then, for each first target cluster, that is, the first cluster where the amount of alarm data exceeds the first preset threshold, the agglomerative hierarchical clustering algorithm is used again. This time, the alarm data in the cluster is subdivided according to the second text similarity to obtain multiple second clusters, which can further identify and merge single-professional alarm events in the same area. The above process can analyze the alarm data at multiple levels through two clusterings, which not only takes into account the geographical distribution, but also focuses on the fault profession, realizes more refined alarm data management and fault identification, and thus solves the technical problem that the relevant alarm processing schemes are difficult to accurately identify and merge large-scale alarm events and have low processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a flow chart of an optional fault alarm management method according to an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of multiple optional alarm data according to an embodiment of the present application;

[0020] Figure 3 This is a schematic diagram of an optional identification and processing result of a regional large-scale alarm event according to an embodiment of the present application;

[0021] Figure 4This is a schematic diagram of an optional identification and processing result of a single-professional large-scale alarm event according to an embodiment of the present application;

[0022] Figure 5 is a structural diagram of an optional fault alarm management device according to an embodiment of the present application;

[0023] Figure 6 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] Example 1

[0027] According to an embodiment of the present application, a fault alarm management method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] Figure 1 is a flow chart of a fault alarm management method provided according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0029] Step S102, obtaining multiple alarm data within a target time period, and determining feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension;

[0030] Step S104, determining a first text similarity and a second text similarity between every two alarm data according to feature vectors of multiple dimensions and weights corresponding to each dimension, wherein when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension;

[0031] Step S106, performing agglomerative hierarchical clustering on the multiple alarm data according to the first text similarity to obtain multiple first clusters, and determining the first cluster including the alarm data whose number exceeds the first preset threshold as the first target cluster, and generating regional large-scale alarm event prompt information according to the first target cluster;

[0032] Step S108: For each first target cluster, perform agglomerative hierarchical clustering on the multiple alarm data in the first target cluster according to the second text similarity to obtain multiple second clusters, and determine that the second cluster including the number of alarm data exceeding the second preset threshold is the second target cluster, and generate single-professional large-scale alarm event prompt information based on the second target cluster.

[0033] The following describes each step of the fault alarm management method in conjunction with a specific implementation process.

[0034] First, multiple alarm data within a target time period are obtained, and feature vectors of multiple dimensions corresponding to each alarm data are determined, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension.

[0035] Among them, the process of obtaining multiple alarm data within the target time period can be carried out in the following steps: using a sliding time window method to determine the time window of the historical time period including the current moment and the preset time length before the current moment as the target time period, and obtaining multiple alarm data within the target time period.

[0036] For example, a dynamic time window strategy, namely a "sliding time window", is adopted. When the system receives new alarm data, it will slide forward a preset time length (such as 5 minutes, 10 minutes or longer) based on the current time point to create a time window. This time window includes all historical alarm data within the current moment and the previous preset time length. The target time period is the time range covered by this sliding time window. In this way, new and recent alarm events can be captured and analyzed in real time or near real time, which is crucial for identifying and responding to sudden large-scale communication failures.

[0037] As an optional implementation, the feature vectors of multiple dimensions corresponding to each alarm data can be determined in the following manner: for each alarm data, determine the target fields of multiple dimensions in the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension, the spatial dimension includes at least one of the following: an alarm area dimension, an alarm sub-area dimension under the alarm area, which helps to identify faults within a specific geographical range, and the fault professional dimension focuses on the specific nature of the fault, including at least one of the following: an alarm name dimension, an alarm device name dimension, and an alarm device location information dimension, these features help to distinguish different types of equipment and faults; for each dimension, use a pre-trained word vector model to determine the word embedding vector corresponding to the target field of the dimension, and count the word frequency and inverse document frequency corresponding to the target field of the dimension, and use the product of the word frequency, inverse document frequency and word embedding vector as the feature vector of the dimension, the word frequency reflects the frequency of occurrence of a word in a single document, and the inverse document frequency measures the rarity of the word in the entire document collection. By multiplying the term frequency and the inverse document frequency, we can get a comprehensive indicator TF-IDF (Term Frequency-Inverse Document Frequency), which can highlight those words that appear frequently in a certain alarm data but are less common in the entire data set. These words are often the key to identifying specific faults.

[0038] After obtaining the feature vectors of the above-mentioned multiple dimensions, the first text similarity and the second text similarity between every two alarm data are determined based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension. When determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension. This means that in the initial stage of cluster analysis, the similarity of geographical location will be given a greater proportion, which is conducive to identifying cross-professional fault events in the same area. When determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension. This can more accurately identify and aggregate alarm events in professional fields, such as large-scale equipment outages or system failures.

[0039] As an optional implementation manner, the first text similarity and the second text similarity between every two warning data are determined according to the feature vectors of multiple dimensions and the weights corresponding to each dimension, and the following steps may be taken:

[0040] For every two alarm data, the cosine similarity between two feature vectors corresponding to the two alarm data in each dimension is determined respectively;

[0041] Obtain a preset first weight mapping relationship and a second weight mapping relationship, wherein in the first weight mapping relationship, the weight corresponding to the feature vector of the spatial dimension is greater than the weight corresponding to the feature vector of the fault professional dimension, and in the second weight mapping relationship, the weight corresponding to the feature vector of the fault professional dimension is greater than the weight corresponding to the feature vector of the spatial dimension;

[0042] The cosine similarities in multiple dimensions are weighted and summed according to the first weight mapping relationship to obtain the first text similarity between the two alarm data. This step focuses on the similarity of the alarm data in terms of geographical location.

[0043] The cosine similarities in multiple dimensions are weighted and summed according to the second weight mapping relationship to obtain the second text similarity between the two alarm data. This step focuses on the similarity of the alarm data in terms of professional nature.

[0044] The first text similarity or the second text similarity can be expressed as:

[0045]

[0046] In the formula, represents the text similarity between alarm data i and alarm data j, m represents the number of features of the alarm data, represents the text similarity of the kth feature of alarm data i and alarm data j, θ k Represents the weight of the k-th feature text similarity, and all weights are normalized.

[0047] As an optional implementation, after determining the first text similarity and the second text similarity between every two warning data according to the feature vectors of multiple dimensions and the weight corresponding to each dimension, the following steps may also be performed:

[0048] For every two warning data, determine the difference between 1 and the first text similarity between the two warning data as the first text distance between the two warning data, and obtain the distance between the two warning data under the weighted spatial dimension;

[0049] Determine the difference between 1 and the second text similarity between the two alarm data as the second text distance between the two alarm data, and obtain the distance between the two alarm data weighted by the fault professional dimension;

[0050] The first text distance or the second text distance can be expressed as:

[0051]

[0052] In the formula, represents the text similarity between alarm data i and alarm data j, d ijIndicates the text distance between warning data i and warning data j.

[0053] A first text distance matrix is ​​constructed based on multiple first text distances, and a second text distance matrix is ​​constructed based on multiple second text distances. These matrices will be used in the subsequent agglomerative hierarchical clustering algorithm to determine the aggregation mode between the alarm data. The first text matrix or the second text matrix can be expressed as:

[0054]

[0055] Where D n×n represents the first text matrix or the second text matrix, and n represents the number of alarm data.

[0056] After obtaining the first text similarity, multiple alarm data are clustered according to the first text similarity to obtain multiple first clusters, and the first cluster including the number of alarm data exceeding the first preset threshold is determined as the first target cluster, and regional large-scale alarm event prompt information is generated according to the first target cluster. Among them, the first preset threshold can be set with reference to the number of professions and the number of alarms in the regional large-scale cross-professional faults in history.

[0057] As an optional implementation, performing agglomerative hierarchical clustering on the plurality of warning data according to the first text similarity may include the following steps:

[0058] Each of the plurality of alarm data is regarded as an independent cluster, and a first cluster distance matrix between the plurality of independent clusters is determined according to the first text distance matrix, wherein the first cluster distance between any two clusters is the first text distance between two alarm data corresponding to the two clusters;

[0059] The following process is executed in a loop until a preset termination condition is met: the minimum first cluster distance is determined from the first cluster distance matrix; if the first cluster distance is not greater than the preset first distance threshold, the two independent clusters corresponding to the minimum first cluster distance are merged into a new cluster; the first cluster distance matrix is ​​updated according to the merging result, wherein the first cluster distance between the new cluster and any other independent cluster is the average of multiple first text distances between each alarm data in the new cluster and each alarm data in the other independent clusters; when the first cluster distance between any two clusters in the first cluster distance matrix is ​​greater than the first distance threshold, the loop is determined to be terminated, indicating that the first target cluster is determined, that is, the first cluster whose number of alarm data exceeds the first preset threshold. These first target clusters reflect the concentration of alarm events in a specific area or spatial range. Prompt information of regional large-scale alarm events can be generated based on these clusters, clearly indicating which areas or sub-areas are experiencing large-scale alarm events.

[0060] After obtaining the first target cluster, for each first target cluster, multiple alarm data in the first target cluster are clustered according to the second text similarity to obtain multiple second clusters, and the second cluster including the number of alarm data exceeding the second preset threshold is determined as the second target cluster, and single-professional large-scale alarm event prompt information is generated according to the second target cluster. Among them, the second preset threshold can be set with reference to the number of alarms in the history of single-professional large-scale failures, the degree of internal impact, the number of baseband processing units and other data.

[0061] As an optional implementation, agglomerative hierarchical clustering is performed on the multiple warning data in the first target cluster according to the second text similarity, and the following steps may be adopted:

[0062] Each of the multiple alarm data in the first target cluster is regarded as an independent cluster, and a second cluster distance matrix between the multiple independent clusters is determined according to the second text distance matrix, wherein the second cluster distance between any two clusters is the second text distance between two alarm data corresponding to the two clusters;

[0063] The following process is executed in a loop until a preset termination condition is met: the minimum second cluster distance is determined from the second cluster distance matrix, and if the second cluster distance is not greater than the preset second distance threshold, the two independent clusters corresponding to the minimum second cluster distance are merged into a new cluster; the second cluster distance matrix is ​​updated according to the merging result, wherein the second cluster distance between the new cluster and any other independent cluster is the average value of multiple second text distances between each alarm data in the new cluster and each alarm data in the other independent clusters; when the second cluster distance between any two clusters in the second cluster distance matrix is ​​greater than the second distance threshold, the loop is determined to be terminated, indicating that the second target cluster is determined according to the result of the second round of clustering, that is, the second cluster with the number of alarm data exceeding the second preset threshold. These second target clusters focus on specific fault professional fields, such as BBU (Baseband Unit) interruption, OLT (Optical Line Terminal) disconnection, etc., and prompt information of single-professional large-scale alarm events is generated based on them, helping the operation and maintenance team to quickly identify and respond to large-scale alarm events within a specific professional scope.

[0064] Through the above two agglomerative hierarchical clustering, the alarm data were merged and analyzed from the spatial dimension and professional dimension respectively, which improved the accuracy and efficiency of large-scale alarm event identification and provided strong data support and decision-making basis for the operation and maintenance management of communication networks.

[0065] In a specific application scenario embodiment, the following five fields in the alarm data are selected as features for processing: area, sub-area, alarm name, device name, and location information, as input features for subsequent processing, such as Figure 2 shown.

[0066] Next, the text similarity calculation method proposed above is used to cluster the alarm data twice based on these five features. Based on expert experience and data analysis, the feature weight setting is fine-tuned. The processed data is clustered using the above algorithm. The inter-cluster distance threshold is set to 0.35 during clustering. The test results are as follows:

[0067] Focusing on the two features of "region" and "sub-region" to cluster the alarm data, it is necessary to increase the weights of the two features of "region" and "sub-region": In this example, [0.45, 0.25, 0.1, 0.1, 0.1] is used as the weight to calculate the weighted sum of similarity and construct the first text similarity matrix. Large-scale alarm events in the clustered identification region can be processed as follows: Figure 3 shown.

[0068] Focusing on "alarm name" and "device name" to perform secondary clustering of alarm data, it is necessary to increase the weights of the two features "alarm name" and "device name": In this example, [0.1, 0.1, 0.4, 0.3, 0.1] is used as the weight to calculate the weighted sum of similarity. The multi-dimensional second text similarity matrix can cluster and identify single-professional large-scale alarm events, such as large-scale BBU outages, to determine the number of BBU outages. The processing results are as follows: Figure 4 shown.

[0069] In an embodiment of the present application, by extracting spatial dimension features (such as regions, sub-regions) and fault professional dimension features (such as alarm names, equipment names, and positioning information) of alarm data and calculating text similarity, the alarm data can be analyzed from a more comprehensive and detailed perspective. When calculating text similarity, by dynamically adjusting weights, key features can be highlighted in different scenarios. When calculating the first text similarity, the weight of the spatial dimension feature vector is set higher, which helps to quickly identify cross-professional alarm events that are geographically adjacent or in the same area. When calculating the second text similarity, the weight of the fault professional dimension feature vector is emphasized, which can more accurately merge alarms with similar properties in professional fields, such as large-scale equipment outages or system failures. In addition, the alarm data is clustered according to the first text similarity to obtain multiple first clusters. This step helps to identify large-scale, cross-professional alarm events. Then, for each first target cluster, that is, the first cluster where the amount of alarm data exceeds the first preset threshold, the agglomerative hierarchical clustering algorithm is used again. This time, the alarm data in the cluster is subdivided according to the second text similarity to obtain multiple second clusters, which can further identify and merge single-professional alarm events in the same area. The above process can analyze the alarm data at multiple levels through two clusterings, which not only takes into account the geographical distribution, but also focuses on the fault profession, realizes more refined alarm data management and fault identification, and thus solves the technical problem that the relevant alarm processing schemes are difficult to accurately identify and merge large-scale alarm events and have low processing efficiency.

[0070] Example 2

[0071] According to an embodiment of the present application, a fault alarm management device for implementing the fault alarm management method in embodiment 1 is also provided. Figure 5 As shown, the fault alarm management device at least includes: an acquisition module 51, a similarity determination module 52, a first clustering module 53 and a second clustering module 54, wherein:

[0072] The acquisition module 51 is used to acquire multiple alarm data within a target time period and determine the feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension;

[0073] A similarity determination module 52, for determining a first text similarity and a second text similarity between every two alarm data according to feature vectors of multiple dimensions and weights corresponding to each dimension, wherein when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension;

[0074] A first clustering module 53 is used to perform agglomerative hierarchical clustering on the multiple alarm data according to the first text similarity to obtain multiple first clusters, and determine the first cluster including the alarm data whose number exceeds the first preset threshold as the first target cluster, and generate regional large-scale alarm event prompt information according to the first target cluster;

[0075] The second clustering module 54 is used to perform agglomerative hierarchical clustering on multiple alarm data in the first target cluster according to the second text similarity for each first target cluster to obtain multiple second clusters, and determine that the second cluster including the number of alarm data exceeding the second preset threshold is the second target cluster, and generate single-professional large-scale alarm event prompt information according to the second target cluster.

[0076] The functions of each module of the fault alarm management device are explained below in conjunction with a specific implementation process.

[0077] The acquisition module acquires multiple alarm data within a target time period, and determines feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension.

[0078] Among them, the process of obtaining multiple alarm data within the target time period can be carried out in the following steps: using a sliding time window method to determine the time window of the historical time period including the current moment and the preset time length before the current moment as the target time period, and obtaining multiple alarm data within the target time period.

[0079] As an optional implementation, the feature vectors of multiple dimensions corresponding to each alarm data can be determined in the following manner: for each alarm data, determine the target fields of multiple dimensions in the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension, the spatial dimension includes at least one of the following: an alarm area dimension, an alarm sub-area dimension under the alarm area, and the fault professional dimension includes at least one of the following: an alarm name dimension, an alarm device name dimension, and an alarm device location information dimension; for each dimension, use a pre-trained word vector model to determine the word embedding vector corresponding to the target field of the dimension, and count the word frequency and inverse document frequency corresponding to the target field of the dimension, and use the product of the word frequency, inverse document frequency and word embedding vector as the feature vector of the dimension.

[0080] After obtaining the feature vectors of the above-mentioned multiple dimensions, the similarity determination module determines the first text similarity and the second text similarity between every two alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein, when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension.

[0081] As an optional implementation manner, the first text similarity and the second text similarity between every two alarm data are determined based on feature vectors of multiple dimensions and the weights corresponding to each dimension. The following steps can be taken: for every two alarm data, the cosine similarity between the two feature vectors corresponding to the two alarm data in each dimension is determined respectively; a preset first weight mapping relationship and a second weight mapping relationship are obtained, wherein in the first weight mapping relationship, the weight corresponding to the feature vector of the spatial dimension is greater than the weight corresponding to the feature vector of the fault professional dimension, and in the second weight mapping relationship, the weight corresponding to the feature vector of the fault professional dimension is greater than the weight corresponding to the feature vector of the spatial dimension; according to the first weight mapping relationship, the cosine similarities in multiple dimensions are weighted and summed to obtain the first text similarity between the two alarm data; according to the second weight mapping relationship, the cosine similarities in multiple dimensions are weighted and summed to obtain the second text similarity between the two alarm data.

[0082] As an optional implementation, after determining the first text similarity and the second text similarity between every two alarm data based on feature vectors of multiple dimensions and the weights corresponding to each dimension, the following steps can also be performed: for every two alarm data, determine that the difference between 1 and the first text similarity between the two alarm data is the first text distance between the two alarm data, and determine that the difference between 1 and the second text similarity between the two alarm data is the second text distance between the two alarm data; construct a first text distance matrix based on multiple first text distances, and construct a second text distance matrix based on multiple second text distances.

[0083] After obtaining the first text similarity, the first clustering module performs agglomerative hierarchical clustering on the multiple alarm data according to the first text similarity to obtain multiple first clusters, and determines that the first cluster including the number of alarm data exceeding the first preset threshold is the first target cluster, and generates regional large-scale alarm event prompt information based on the first target cluster.

[0084] As an optional implementation, performing agglomerative hierarchical clustering on multiple alarm data based on the first text similarity may include the following steps: treating each alarm data in the multiple alarm data as an independent cluster, and determining the first cluster distance matrix between the multiple independent clusters based on the first text distance matrix, wherein the first cluster distance between any two clusters is the first text distance between the two alarm data corresponding to the two clusters; looping the following process until a preset termination condition is met: determining the minimum first cluster distance from the first cluster distance matrix, and if the first cluster distance is not greater than a preset first distance threshold, merging the two independent clusters corresponding to the minimum first cluster distance into a new cluster; updating the first cluster distance matrix based on the merging result, wherein the first cluster distance between the new cluster and any other independent cluster is the average of multiple first text distances between each alarm data in the new cluster and each alarm data in the other independent clusters; determining that the loop is terminated when the first cluster distances between any two clusters in the first cluster distance matrix are greater than the first distance threshold.

[0085] After obtaining the first target cluster, for each first target cluster, the second clustering module performs agglomerative hierarchical clustering on multiple alarm data in the first target cluster based on the second text similarity to obtain multiple second clusters, and determines that the second cluster including the number of alarm data exceeding the second preset threshold is the second target cluster, and generates single-professional large-scale alarm event prompt information based on the second target cluster.

[0086] As an optional implementation, agglomerative hierarchical clustering is performed on multiple alarm data in the first target cluster based on the second text similarity. The following steps can be adopted: each alarm data in the multiple alarm data in the first target cluster is regarded as an independent cluster, and a second cluster distance matrix between the multiple independent clusters is determined based on the second text distance matrix, wherein the second cluster distance between any two clusters is the second text distance between the two alarm data corresponding to the two clusters; the following process is executed in a loop until a preset termination condition is met: the minimum second cluster distance is determined from the second cluster distance matrix, and if the second cluster distance is not greater than the preset second distance threshold, the two independent clusters corresponding to the minimum second cluster distance are merged into a new cluster; the second cluster distance matrix is ​​updated based on the merging result, wherein the second cluster distance between the new cluster and any other independent cluster is the average of multiple second text distances between each alarm data in the new cluster and each alarm data in the other independent clusters; when the second cluster distance between any two clusters in the second cluster distance matrix is ​​greater than the second distance threshold, the loop is determined to be terminated.

[0087] It should be noted that each module in the fault alarm management device in the embodiment of the present application corresponds one by one to each implementation step of the fault alarm management method in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be repeated here.

[0088] Example 3

[0089] According to an embodiment of the present application, a computer program product is also provided. The computer program product includes a computer program, wherein when the computer program is executed by a processor, the fault alarm management method in Embodiment 1 is implemented.

[0090] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the fault alarm management method in Example 1 by running the computer program.

[0091] According to an embodiment of the present application, a processor is further provided, which is used to run a computer program, wherein the fault alarm management method in Example 1 is executed when the computer program is running.

[0092] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the fault alarm management method in Example 1 through the computer program.

[0093] Specifically, the computer program executes the following steps when it is running: obtaining multiple alarm data within a target time period, and determining feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension; determining a first text similarity and a second text similarity between every two alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension; performing agglomerative hierarchical clustering on the multiple alarm data based on the first text similarity to obtain multiple first clusters, and determining a first cluster including alarm data with a number exceeding a first preset threshold as a first target cluster, and generating regional large-scale alarm event prompt information based on the first target cluster; for each first target cluster, performing agglomerative hierarchical clustering on the multiple alarm data in the first target cluster based on the second text similarity to obtain multiple second clusters, and determining a second cluster including alarm data with a number exceeding a second preset threshold as a second target cluster, and generating single-professional large-scale alarm event prompt information based on the second target cluster.

[0094] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 6 FIG. 1 shows a hardware structure block diagram of an electronic device for implementing a fault alarm management method. Figure 6 As shown, the electronic device 60 may include one or more (602a, 602b, ..., 602n are used to illustrate) processors 602 (the processor 602 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 604 for storing data, and a transmission device 606 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 6 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 6 More or fewer components as shown, or with Figure 6 Different configurations are shown.

[0095] It should be noted that the one or more processors 602 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the electronic device 60. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0096] The memory 604 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the fault alarm management method in the embodiment of the present application. The processor 602 executes various functional applications and data processing by running the software programs and modules stored in the memory 604, that is, realizing the vulnerability detection method of the above-mentioned application. The memory 604 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 604 may further include a memory remotely arranged relative to the processor 602, and these remote memories may be connected to the electronic device 60 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0097] The transmission device 606 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 60. In one example, the transmission device 606 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 606 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0098] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 60 .

[0099] The serial numbers of the above embodiments are only for description and do not represent the advantages or disadvantages of the embodiments.

[0100] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0101] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0102] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0103] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0104] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0105] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A fault alarm management method, characterized in that: include: Acquire multiple alarm data within a target time period, and determine feature vectors of multiple dimensions corresponding to each of the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension; Determine a first text similarity and a second text similarity between every two of the alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension; Performing agglomerative hierarchical clustering on the plurality of alarm data according to the first text similarity to obtain a plurality of first clusters, determining a first cluster including alarm data whose number exceeds a first preset threshold as a first target cluster, and generating regional large-scale alarm event prompt information according to the first target cluster; For each of the first target clusters, agglomerative hierarchical clustering is performed on the multiple alarm data in the first target cluster according to the second text similarity to obtain multiple second clusters, and the second cluster including the number of alarm data exceeding the second preset threshold is determined as the second target cluster, and single-professional large-scale alarm event prompt information is generated based on the second target cluster.

2. The method according to claim 1, characterized in that Get multiple alarm data within the target time period, including: A sliding time window is used to determine a time window of a historical time period including the current time and a preset time period before the current time as the target time period, and multiple alarm data within the target time period are obtained.

3. The method according to claim 1, characterized in that Determining feature vectors of multiple dimensions corresponding to each of the alarm data includes: For each of the alarm data, determine a target field of multiple dimensions in the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension, the spatial dimension includes at least one of the following: an alarm area dimension, an alarm sub-area dimension under the alarm area, and the fault professional dimension includes at least one of the following: an alarm name dimension, an alarm device name dimension, and an alarm device location information dimension; For each dimension, a pre-trained word vector model is used to determine the word embedding vector corresponding to the target field of the dimension, and the word frequency and inverse document frequency corresponding to the target field of the dimension are counted, and the product of the word frequency, the inverse document frequency and the word embedding vector is used as the feature vector of the dimension.

4. The method according to claim 1, characterized in that Determining a first text similarity and a second text similarity between every two pieces of the warning data according to the feature vectors of the multiple dimensions and the weights corresponding to each dimension includes: For every two alarm data, respectively determine the cosine similarity between two feature vectors corresponding to the two alarm data in each dimension; Obtain a preset first weight mapping relationship and a second weight mapping relationship, wherein, in the first weight mapping relationship, the weight corresponding to the feature vector of the spatial dimension is greater than the weight corresponding to the feature vector of the fault professional dimension, and in the second weight mapping relationship, the weight corresponding to the feature vector of the fault professional dimension is greater than the weight corresponding to the feature vector of the spatial dimension; Performing weighted summation on the cosine similarities in multiple dimensions according to the first weight mapping relationship to obtain the first text similarity between the two warning data; The cosine similarities in multiple dimensions are weighted and summed according to the second weight mapping relationship to obtain the second text similarity between the two warning data.

5. The method according to claim 1, characterized in that: After determining the first text similarity and the second text similarity between every two pieces of the warning data according to the feature vectors of the multiple dimensions and the weights corresponding to each dimension, the method further includes: For every two warning data, determine the difference between 1 and the first text similarity between the two warning data as the first text distance between the two warning data, and determine the difference between 1 and the second text similarity between the two warning data as the second text distance between the two warning data; A first text distance matrix is ​​constructed according to a plurality of the first text distances, and a second text distance matrix is ​​constructed according to a plurality of the second text distances.

6. The method according to claim 5, characterized in that Performing agglomerative hierarchical clustering on the plurality of warning data according to the first text similarity includes: Taking each of the plurality of warning data as an independent cluster, and determining a first cluster distance matrix between the plurality of independent clusters according to the first text distance matrix, wherein the first cluster distance between any two clusters is the first text distance between two warning data corresponding to the two clusters; The following process is executed repeatedly until the preset termination condition is met: determining a minimum first cluster distance from the first cluster distance matrix, and if the first cluster distance is not greater than a preset first distance threshold, merging two independent clusters corresponding to the minimum first cluster distance into a new cluster; updating the first cluster distance matrix according to the merging result, wherein the first cluster distance between the new cluster and any other independent cluster is an average value of a plurality of first text distances between each warning data in the new cluster and each warning data in the other independent cluster; When the first cluster distance between any two clusters in the first cluster distance matrix is ​​greater than the first distance threshold, it is determined that the loop is terminated.

7. The method according to claim 5, characterized in that Performing agglomerative hierarchical clustering on the plurality of warning data in the first target cluster according to the second text similarity includes: Taking each of the multiple warning data in the first target cluster as an independent cluster, and determining a second cluster distance matrix between the multiple independent clusters according to the second text distance matrix, wherein the second cluster distance between any two clusters is the second text distance between two warning data corresponding to the two clusters; The following process is executed repeatedly until the preset termination condition is met: determining a minimum second cluster distance from the second cluster distance matrix, and if the second cluster distance is not greater than a preset second distance threshold, merging two independent clusters corresponding to the minimum second cluster distance into a new cluster; updating the second cluster distance matrix according to the merging result, wherein the second cluster distance between the new cluster and any other independent cluster is an average value of multiple second text distances between each warning data in the new cluster and each warning data in the other independent cluster; When the second cluster distance between any two clusters in the second cluster distance matrix is ​​greater than the second distance threshold, it is determined that the loop is terminated.

8. A fault alarm management device, characterized in that: include: An acquisition module, used to acquire multiple alarm data within a target time period, and determine feature vectors of multiple dimensions corresponding to each of the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension; A similarity determination module, used to determine the first text similarity and the second text similarity between every two of the alarm data according to the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension; a first clustering module, configured to perform agglomerative hierarchical clustering on the plurality of alarm data according to the first text similarity to obtain a plurality of first clusters, determine a first cluster including alarm data whose number exceeds a first preset threshold as a first target cluster, and generate regional large-scale alarm event prompt information according to the first target cluster; The second clustering module is used to perform agglomerative hierarchical clustering on the multiple alarm data in the first target cluster according to the second text similarity for each of the first target clusters to obtain multiple second clusters, and determine that the second cluster including the number of alarm data exceeding the second preset threshold is the second target cluster, and generate single-professional large-scale alarm event prompt information based on the second target cluster.

9. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, the fault alarm management method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the fault alarm management method according to any one of claims 1 to 7 through the computer program.

Images