Fault alarm management method and device

Abstract

The application discloses a fault alarm management method and device. Wherein, the method comprises: acquiring a plurality of alarm data in a target time period, determining the feature vector of each alarm data corresponding to the space involved and the fault professional dimension; according to the feature vector, calculating the first text similarity between each two alarm data focusing on the space dimension and the second text similarity focusing on the fault professional dimension; based on the first text similarity, clustering all alarm data to obtain a plurality of clusters, determining that the first target cluster containing alarm data exceeding the first threshold value, generating a large-scale alarm prompt information of the region; based on the second text similarity, clustering the alarm data in the first target cluster to obtain a plurality of clusters, determining that the second target cluster containing alarm data exceeding the second threshold value, generating a large-scale alarm prompt information of a single professional. The application solves the technical problem that the related alarm processing scheme is difficult to accurately identify and merge for large-scale alarm events, and the processing efficiency is low.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a fault alarm management method and device. Background Art

[0002] With the rapid development of information technology, especially in critical infrastructure sectors such as communications and data centers, network operations and maintenance management have become core elements for ensuring business continuity and stability. However, as systems continue to expand in scale and complexity, the volume of alarms generated by monitoring systems has skyrocketed. These alarms include not only a large number of duplicate and false alarms, but also correlated alarms caused by interdependencies and impacts between devices. The massive increase and complexity of alarm information significantly increases the difficulty of fault diagnosis and location, making network system operation and maintenance more complex, presenting unprecedented challenges to operations and maintenance teams, and severely impacting alarm handling efficiency. When communications networks experience large-scale alarm events, maintenance personnel must rapidly investigate and locate the affected areas within a very short period of time. Therefore, accurately identifying these large-scale alarms within the massive volume of communications network alarm data is crucial. This facilitates rapid fault identification, precise ticket dispatching, and effective work order consolidation, enabling frontline teams to efficiently perform daily operations and troubleshooting tasks.

[0003] Traditional alarm merging and convergence methods often rely on manually defined rules and rule-based alarm aggregation. Although this method can reduce the occurrence of duplicate alarms and false alarms to a certain extent, its flexibility and scalability are limited, making it difficult to cope with the increasingly complex alarm environment. Especially when the system scale continues to expand and the device types become more diverse, the rule-based method requires frequent updates and adjustments, which undoubtedly increases the complexity and cost of operation and maintenance work.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present application provide a fault alarm management method and device to at least solve the technical problem that related alarm processing solutions are difficult to accurately identify and merge large-scale alarm events and have low processing efficiency.

[0006] According to one aspect of an embodiment of the present application, a fault alarm management method is provided, comprising: obtaining multiple alarm data within a target time period, and determining feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension; determining a first text similarity and a second text similarity between each two alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein, when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension; performing agglomerative hierarchical clustering on the multiple alarm data based on the first text similarity to obtain multiple first clusters, determining a first cluster including alarm data whose number exceeds a first preset threshold as a first target cluster, and generating regional large-scale alarm event prompt information based on the first target cluster; for each first target cluster, performing agglomerative hierarchical clustering on the multiple alarm data in the first target cluster based on the second text similarity to obtain multiple second clusters, determining a second cluster including alarm data whose number exceeds a second preset threshold as a second target cluster, and generating single-professional large-scale alarm event prompt information based on the second target cluster.

[0007] Optionally, obtaining multiple alarm data within a target time period includes: using a sliding time window to determine a time window including a historical time period of a preset length before the current moment as the target time period, and obtaining multiple alarm data within the target time period.

[0008] Optionally, determining the feature vectors of multiple dimensions corresponding to each alarm data includes: for each alarm data, determining the target fields of multiple dimensions in the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension, the spatial dimension includes at least one of the following: an alarm area dimension, an alarm sub-area dimension under the alarm area, and the fault professional dimension includes at least one of the following: an alarm name dimension, an alarm device name dimension, and an alarm device positioning information dimension; for each dimension, using a pre-trained word vector model to determine the word embedding vector corresponding to the target field of the dimension, and counting the word frequency and inverse document frequency corresponding to the target field of the dimension, and taking the product of the word frequency, inverse document frequency and word embedding vector as the feature vector of the dimension.

[0009] Optionally, the first text similarity and the second text similarity between each two alarm data are determined based on the feature vectors of multiple dimensions and the weights corresponding to each dimension, including: for each two alarm data, respectively determining the cosine similarity between the two feature vectors corresponding to the two alarm data in each dimension; obtaining a preset first weight mapping relationship and a second weight mapping relationship, wherein, in the first weight mapping relationship, the weight corresponding to the feature vector of the spatial dimension is greater than the weight corresponding to the feature vector of the fault professional dimension, and in the second weight mapping relationship, the weight corresponding to the feature vector of the fault professional dimension is greater than the weight corresponding to the feature vector of the spatial dimension; performing weighted summation of the cosine similarities in multiple dimensions according to the first weight mapping relationship to obtain the first text similarity between the two alarm data; performing weighted summation of the cosine similarities in multiple dimensions according to the second weight mapping relationship to obtain the second text similarity between the two alarm data.

[0010] Optionally, after determining the first text similarity and the second text similarity between each two alarm data based on the feature vectors of multiple dimensions and the weights corresponding to each dimension, the method also includes: for each two alarm data, determining the difference between 1 and the first text similarity between the two alarm data as the first text distance between the two alarm data, and determining the difference between 1 and the second text similarity between the two alarm data as the second text distance between the two alarm data; constructing a first text distance matrix based on multiple first text distances, and constructing a second text distance matrix based on multiple second text distances.

[0011] Optionally, agglomerative hierarchical clustering is performed on multiple alarm data based on the first text similarity, including: treating each alarm data in the multiple alarm data as an independent cluster, and determining the first cluster distance matrix between the multiple independent clusters based on the first text distance matrix, wherein the first cluster distance between any two clusters is the first text distance between the two alarm data corresponding to the two clusters; looping the following process until a preset termination condition is met: determining the minimum first cluster distance from the first cluster distance matrix, and if the first cluster distance is not greater than a preset first distance threshold, merging the two independent clusters corresponding to the minimum first cluster distance into a new cluster; updating the first cluster distance matrix based on the merging result, wherein the first cluster distance between the new cluster and any other independent cluster is the average of multiple first text distances between each alarm data in the new cluster and each alarm data in the other independent clusters; determining that the loop is terminated when the first cluster distance between any two clusters in the first cluster distance matrix is ​​greater than the first distance threshold.

[0012] Optionally, agglomerative hierarchical clustering is performed on multiple alarm data in the first target cluster based on the second text similarity, including: treating each alarm data in the multiple alarm data in the first target cluster as an independent cluster, and determining a second cluster distance matrix between the multiple independent clusters based on the second text distance matrix, wherein the second cluster distance between any two clusters is the second text distance between the two alarm data corresponding to the two clusters; looping the following process until a preset termination condition is met: determining the minimum second cluster distance from the second cluster distance matrix, and if the second cluster distance is not greater than a preset second distance threshold, merging the two independent clusters corresponding to the minimum second cluster distance into a new cluster; updating the second cluster distance matrix based on the merging result, wherein the second cluster distance between the new cluster and any other independent cluster is the average of multiple second text distances between each alarm data in the new cluster and each alarm data in the other independent clusters; determining that the loop is terminated when the second cluster distance between any two clusters in the second cluster distance matrix is ​​greater than the second distance threshold.

[0013] According to another aspect of an embodiment of the present application, a fault alarm management device is also provided, including: an acquisition module for acquiring multiple alarm data within a target time period, and determining feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension; a similarity determination module for determining a first text similarity and a second text similarity between each two alarm data based on the feature vectors of multiple dimensions and the weights corresponding to each dimension, wherein, when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the fault professional dimension. The weight is greater than the weight of the eigenvector of the spatial dimension; the first clustering module is used to perform agglomerative hierarchical clustering on multiple alarm data according to the first text similarity to obtain multiple first clusters, and determine the first cluster including the number of alarm data exceeding the first preset threshold as the first target cluster, and generate regional large-scale alarm event prompt information based on the first target cluster; the second clustering module is used to perform agglomerative hierarchical clustering on multiple alarm data in the first target cluster according to the second text similarity for each first target cluster to obtain multiple second clusters, and determine the second cluster including the number of alarm data exceeding the second preset threshold as the second target cluster, and generate single-professional large-scale alarm event prompt information based on the second target cluster.

[0014] According to another aspect of an embodiment of the present application, a computer program product is further provided. The computer program product includes: a computer program, wherein when the computer program is executed by a processor, the above-mentioned fault alarm management method is implemented.

[0015] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned fault alarm management method through the computer program.

[0016] In an embodiment of the present application, by extracting the spatial dimension features (such as regions, sub-regions) and fault professional dimension features (such as alarm names, equipment names, and location information) of the alarm data and calculating the text similarity, the alarm data can be analyzed from a more comprehensive and detailed perspective. When calculating the text similarity, by dynamically adjusting the weights, key features can be highlighted in different scenarios. When calculating the first text similarity, the weight of the spatial dimension feature vector is set higher, which helps to quickly identify cross-professional alarm events that are geographically adjacent or in the same area. When calculating the second text similarity, the weight of the fault professional dimension feature vector is emphasized, which can more accurately merge alarms with similar properties in professional fields, such as large-scale equipment outages or system failures. In addition, the alarm data is clustered according to the first text similarity to obtain multiple first clusters. This step helps to identify large-scale, cross-professional alarm events. Then, for each first target cluster, that is, the first cluster where the amount of alarm data exceeds the first preset threshold, the agglomerative hierarchical clustering algorithm is used again. This time, the alarm data in the cluster is subdivided according to the second text similarity to obtain multiple second clusters, which can further identify and merge single-professional alarm events in the same area. The above process can analyze the alarm data at multiple levels through two clusterings, taking into account the geographical distribution and focusing on the fault profession, realizing more refined alarm data management and fault identification, and thus solving the technical problem that the relevant alarm processing solutions are difficult to accurately identify and merge large-scale alarm events and have low processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 This is a flow chart of an optional fault alarm management method according to an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of multiple optional alarm data according to an embodiment of the present application;

[0020] Figure 3 This is a schematic diagram of an optional identification and processing result of a regional large-scale alarm event according to an embodiment of the present application;

[0021] Figure 4This is a schematic diagram of an optional identification and processing result of a single-professional large-scale alarm event according to an embodiment of the present application;

[0022] Figure 5 is a schematic structural diagram of an optional fault alarm management device according to an embodiment of the present application;

[0023] Figure 6 It is a schematic structural diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0025] It should be noted that the terms "first", "second", etc. in the specification, claims, and drawings of the present application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0026] Example 1

[0027] According to an embodiment of the present application, a fault alarm management method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] Figure 1 FIG. 1 is a flow chart of a fault alarm management method provided in accordance with an embodiment of the present application, such as Figure 1 As shown, the method includes the following steps:

[0029] Step S102: Acquire multiple alarm data within a target time period, and determine feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault-specific dimension;

[0030] Step S104: determining a first text similarity and a second text similarity between each pair of alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein, when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension; and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension;

[0031] Step S106: performing agglomerative hierarchical clustering on the plurality of alarm data based on the first text similarity to obtain a plurality of first clusters, determining a first cluster including alarm data exceeding a first preset threshold as a first target cluster, and generating regional large-scale alarm event prompt information based on the first target cluster;

[0032] Step S108: For each first target cluster, perform agglomerative hierarchical clustering on the multiple alarm data in the first target cluster based on the second text similarity to obtain multiple second clusters, and determine that the second cluster including the number of alarm data exceeding the second preset threshold is the second target cluster, and generate single-professional large-scale alarm event prompt information based on the second target cluster.

[0033] The following describes the various steps of the fault alarm management method in conjunction with a specific implementation process.

[0034] First, multiple alarm data within a target time period are obtained, and feature vectors of multiple dimensions corresponding to each alarm data are determined, where the multiple dimensions include: a spatial dimension and a fault professional dimension.

[0035] Among them, the process of obtaining multiple alarm data within the target time period can be carried out in the following steps: using a sliding time window to determine the time window of the historical time period including the current moment and the preset time length before the current moment as the target time period, and obtaining multiple alarm data within the target time period.

[0036] For example, a dynamic time window strategy, known as a "sliding time window," is employed. When the system receives new alarm data, it slides forward a preset time length (such as 5 minutes, 10 minutes, or longer) based on the current time point to create a time window. This time window includes all historical alarm data from the current moment and the previous preset time length. The target time period is the time range covered by this sliding time window. This approach enables the capture and analysis of new and recent alarm events in real time or near real time, which is crucial for identifying and responding to sudden, large-scale communication failures.

[0037] As an optional implementation, the feature vectors of multiple dimensions corresponding to each alarm data can be determined in the following manner: for each alarm data, the target fields of multiple dimensions in the alarm data are determined, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension. The spatial dimension includes at least one of the following: an alarm area dimension, an alarm sub-area dimension under the alarm area, which helps to identify faults within a specific geographical range. The fault professional dimension focuses on the specific nature of the fault, including at least one of the following: an alarm name dimension, an alarm device name dimension, and an alarm device location information dimension. These features help to distinguish different types of equipment and faults. For each dimension, a pre-trained word vector model is used to determine the word embedding vector corresponding to the target field of the dimension, and the word frequency and inverse document frequency corresponding to the target field of the dimension are counted. The product of the word frequency, inverse document frequency and word embedding vector is used as the feature vector of the dimension. The word frequency reflects the frequency of occurrence of a word in a single document, while the inverse document frequency measures the rarity of the word in the entire document collection. By multiplying the term frequency by the inverse document frequency, we can obtain a comprehensive metric called TF-IDF (Term Frequency-Inverse Document Frequency). This metric can highlight words that appear frequently in a particular alarm data set but are less common in the entire dataset. These words are often key to identifying specific faults.

[0038] After obtaining the feature vectors of the above-mentioned multiple dimensions, the first text similarity and the second text similarity between each two alarm data are determined based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension. When determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension. This means that in the initial stage of cluster analysis, the similarity of geographical location will be given a greater proportion, which is conducive to identifying cross-professional fault events in the same area. When determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension. This can more accurately identify and aggregate alarm events in professional fields, such as large-scale equipment interruptions or system failures.

[0039] As an optional implementation, the first text similarity and the second text similarity between each two pieces of warning data are determined based on feature vectors of multiple dimensions and weights corresponding to each dimension. The following steps may be taken:

[0040] For each pair of alarm data, determine the cosine similarity between the two feature vectors corresponding to the two alarm data in each dimension;

[0041] Obtain a preset first weight mapping relationship and a second weight mapping relationship, wherein, in the first weight mapping relationship, the weight corresponding to the feature vector of the spatial dimension is greater than the weight corresponding to the feature vector of the fault professional dimension, and in the second weight mapping relationship, the weight corresponding to the feature vector of the fault professional dimension is greater than the weight corresponding to the feature vector of the spatial dimension;

[0042] The cosine similarities under multiple dimensions are weighted and summed according to the first weight mapping relationship to obtain the first text similarity between the two alarm data. This step focuses on the similarity of the alarm data in terms of geographical location.

[0043] The cosine similarities in multiple dimensions are weighted and summed according to the second weight mapping relationship to obtain the second text similarity between the two alarm data. This step focuses on the similarity of the professional nature of the alarm data.

[0044] The first text similarity or the second text similarity can be expressed as:

[0045]

[0046] Where, represents the text similarity between alarm data i and alarm data j, m represents the number of features of the alarm data, represents the text similarity of the kth feature of alarm data i and alarm data j, θ k Represents the weight of the k-th feature text similarity, and all weights are normalized.

[0047] As an optional implementation, after determining the first text similarity and the second text similarity between every two pieces of warning data based on the feature vectors of multiple dimensions and the weights corresponding to each dimension, the following steps may be further performed:

[0048] For each pair of alarm data, determine the difference between 1 and the first text similarity between the two alarm data as the first text distance between the two alarm data, and obtain the distance between the two alarm data under the weighted spatial dimension;

[0049] Determine the difference between 1 and the second text similarity between the two alarm data as the second text distance between the two alarm data, and obtain the distance between the two alarm data under the weight of the fault professional dimension;

[0050] The first text distance or the second text distance can be expressed as:

[0051]

[0052] Where, Denotes the text similarity between alarm data i and alarm data j, d ijIndicates the text distance between alarm data i and alarm data j.

[0053] A first text distance matrix is ​​constructed based on multiple first text distances, and a second text distance matrix is ​​constructed based on multiple second text distances. These matrices will be used in the subsequent agglomerative hierarchical clustering algorithm to determine the aggregation method between the alarm data. The first text matrix or the second text matrix can be expressed as:

[0054]

[0055] Where D n×n Represents the first text matrix or the second text matrix, and n represents the number of alarm data.

[0056] After obtaining the first text similarity, agglomerative hierarchical clustering is performed on the multiple alarm data based on the first text similarity to obtain multiple first clusters. The first cluster containing alarm data exceeding a first preset threshold is determined as a first target cluster, and regional large-scale alarm event prompt information is generated based on the first target cluster. The first preset threshold can be set based on historical data such as the number of disciplines involved and the number of alarms in regional, cross-disciplinary, large-scale faults.

[0057] As an optional implementation, performing agglomerative hierarchical clustering on the plurality of alarm data according to the first text similarity may include the following steps:

[0058] Each alarm data in the plurality of alarm data is regarded as an independent cluster, and a first cluster distance matrix between the plurality of independent clusters is determined based on the first text distance matrix, wherein the first cluster distance between any two clusters is the first text distance between two alarm data corresponding to the two clusters;

[0059] The following process is executed in a loop until a preset termination condition is met: the minimum first cluster distance is determined from the first cluster distance matrix; if the first cluster distance is not greater than the preset first distance threshold, the two independent clusters corresponding to the minimum first cluster distance are merged into a new cluster; the first cluster distance matrix is ​​updated based on the merging result, wherein the first cluster distance between the new cluster and any other independent cluster is the average of multiple first text distances between each alarm data in the new cluster and each alarm data in the other independent clusters; when the first cluster distance between any two clusters in the first cluster distance matrix is ​​greater than the first distance threshold, the loop is terminated, indicating that the first target cluster has been determined, that is, the first cluster whose number of alarm data exceeds the first preset threshold. These first target clusters reflect the concentration of alarm events in a specific area or spatial range. Prompt information of regional large-scale alarm events can be generated based on these clusters, clearly indicating which areas or sub-areas are experiencing large-scale alarm events.

[0060] After obtaining the first target cluster, for each first target cluster, the plurality of alarm data in the first target cluster is subjected to agglomerative hierarchical clustering according to a second text similarity, a plurality of second clusters is obtained, and a second cluster including alarm data whose quantity exceeds a second preset threshold is determined as a second target cluster, and a single-professional large-scale alarm event prompt information is generated according to the second target cluster. The second preset threshold can be set by referring to alarm quantity, internal influence degree, baseband processing unit quantity and the like in a historical single-professional large-area fault.

[0061] As an optional implementation, the plurality of alarm data in the first target cluster can be subjected to agglomerative hierarchical clustering according to the second text similarity by using the following steps:

[0062] Each alarm data in the plurality of alarm data in the first target cluster is taken as an independent cluster, and a second cluster distance matrix between the plurality of independent clusters is determined according to the second text distance matrix, wherein the second cluster distance between any two clusters is the second text distance between two alarm data corresponding to the two clusters.

[0063] The following process is executed in a loop until a preset termination condition is met: the smallest second cluster distance is determined from the second cluster distance matrix, if the second cluster distance is not greater than a preset second distance threshold, two independent clusters corresponding to the smallest second cluster distance are merged into a new cluster; the second cluster distance matrix is updated according to the merging result, wherein the second cluster distance between the new cluster and any other independent cluster is the average of a plurality of second text distances between each alarm data in the new cluster and each alarm data in the other independent cluster; in the case that the second cluster distance between any two clusters in the second cluster distance matrix is greater than the second distance threshold, it is determined that the loop is terminated, indicating that the second target cluster is determined according to the result of the second round of clustering, i.e., the second cluster whose alarm data quantity exceeds the second preset threshold, these second target clusters focus on specific fault professional fields, such as BBU (Baseband Unit) interruption, OLT (Optical Line Terminal) disconnection, etc., and the prompt information of the single-professional large-scale alarm event is generated according to them, helping the operation and maintenance team to quickly identify and respond to large-scale alarm events in a specific professional range.

[0064] Through the above two agglomerative hierarchical clusterings, the alarm data is merged and analyzed from the spatial dimension and the professional dimension respectively, improving the accuracy and efficiency of large-scale alarm event identification, and providing powerful data support and decision basis for the operation and management of communication networks.

[0065] In one specific application scenario embodiment, the following five fields in the alarm data are selected as features for processing: region, sub-region, alarm name, device name, and positioning information, which are taken as input features for subsequent processing, such as Figure 2 shown.

[0066] Next, we used the text similarity calculation method proposed above to cluster the alarm data twice based on these five features. Based on expert experience and data analysis, we fine-tuned the feature weight settings and used the above algorithm to perform agglomerative hierarchical clustering on the processed data. The inter-cluster distance threshold was set to 0.35 during clustering. The test results are as follows:

[0067] Focusing on the two features of "region" and "sub-region" to cluster the alarm data, it is necessary to increase the weights of the two features of "region" and "sub-region": In this example, the weighted sum of similarities is calculated with [0.45, 0.25, 0.1, 0.1, 0.1], and the first text similarity matrix is ​​constructed. Large-scale alarm events in the region can be clustered and identified. The processing results are as follows: Figure 3 shown.

[0068] Focusing on "alarm name" and "device name" to perform secondary clustering on alarm data, it is necessary to increase the weights of the two features "alarm name" and "device name": In this example, the weighted sum of similarity is calculated with [0.1, 0.1, 0.4, 0.3, 0.1] as the weight. The multi-dimensional second text similarity matrix can cluster and identify single-professional large-scale alarm events, such as large-scale BBU outages, to determine the number of BBU outages. The processing results are as follows: Figure 4 shown.

[0069] In an embodiment of the present application, by extracting the spatial dimension features (such as regions, sub-regions) and fault professional dimension features (such as alarm names, equipment names, and location information) of the alarm data and calculating the text similarity, the alarm data can be analyzed from a more comprehensive and detailed perspective. When calculating the text similarity, by dynamically adjusting the weights, key features can be highlighted in different scenarios. When calculating the first text similarity, the weight of the spatial dimension feature vector is set higher, which helps to quickly identify cross-professional alarm events that are geographically adjacent or in the same area. When calculating the second text similarity, the weight of the fault professional dimension feature vector is emphasized, which can more accurately merge alarms with similar properties in professional fields, such as large-scale equipment outages or system failures. In addition, the alarm data is clustered according to the first text similarity to obtain multiple first clusters. This step helps to identify large-scale, cross-professional alarm events. Then, for each first target cluster, that is, the first cluster where the amount of alarm data exceeds the first preset threshold, the agglomerative hierarchical clustering algorithm is used again. This time, the alarm data in the cluster is subdivided according to the second text similarity to obtain multiple second clusters, which can further identify and merge single-professional alarm events in the same area. The above process can analyze the alarm data at multiple levels through two clusterings, taking into account the geographical distribution and focusing on the fault profession, realizing more refined alarm data management and fault identification, and thus solving the technical problem that the relevant alarm processing solutions are difficult to accurately identify and merge large-scale alarm events and have low processing efficiency.

[0070] Example 2

[0071] According to an embodiment of the present application, a fault alarm management device for implementing the fault alarm management method in embodiment 1 is also provided. Figure 5 As shown, the fault alarm management device at least includes: an acquisition module 51, a similarity determination module 52, a first clustering module 53 and a second clustering module 54, wherein:

[0072] An acquisition module 51 is configured to acquire multiple alarm data within a target time period and determine a feature vector of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault-specific dimension;

[0073] A similarity determination module 52 is configured to determine a first text similarity and a second text similarity between each pair of alarm data based on feature vectors of multiple dimensions and weights corresponding to each dimension, wherein, when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension; and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension;

[0074] a first clustering module 53 for performing agglomerative hierarchical clustering on the plurality of alarm data based on the first text similarity to obtain a plurality of first clusters, determining a first cluster including alarm data exceeding a first preset threshold as a first target cluster, and generating regional large-scale alarm event prompt information based on the first target cluster;

[0075] The second clustering module 54 is used to perform agglomerative hierarchical clustering on the multiple alarm data in the first target cluster according to the second text similarity for each first target cluster to obtain multiple second clusters, and determine that the second cluster including the number of alarm data exceeding the second preset threshold is the second target cluster, and generate single-professional large-scale alarm event prompt information based on the second target cluster.

[0076] The following describes the functions of each module of the fault alarm management device in conjunction with a specific implementation process.

[0077] The acquisition module acquires multiple alarm data within a target time period and determines feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension.

[0078] Among them, the process of obtaining multiple alarm data within the target time period can be carried out in the following steps: using a sliding time window to determine the time window of the historical time period including the current moment and the preset time length before the current moment as the target time period, and obtaining multiple alarm data within the target time period.

[0079] As an optional implementation, the feature vectors of multiple dimensions corresponding to each alarm data can be determined in the following manner: for each alarm data, determine the target fields of multiple dimensions in the alarm data, wherein the multiple dimensions include: spatial dimension and fault professional dimension, the spatial dimension includes at least one of the following: alarm area dimension, alarm sub-area dimension under the alarm area, and the fault professional dimension includes at least one of the following: alarm name dimension, alarm device name dimension, alarm device positioning information dimension; for each dimension, use a pre-trained word vector model to determine the word embedding vector corresponding to the target field of the dimension, and count the word frequency and inverse document frequency corresponding to the target field of the dimension, and use the product of the word frequency, inverse document frequency and word embedding vector as the feature vector of the dimension.

[0080] After obtaining the feature vectors of the above-mentioned multiple dimensions, the similarity determination module determines the first text similarity and the second text similarity between each two alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension. When determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension. When determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension.

[0081] As an optional implementation manner, the first text similarity and the second text similarity between each two alarm data are determined based on the feature vectors of multiple dimensions and the weights corresponding to each dimension. The following steps can be taken: for each two alarm data, the cosine similarity between the two feature vectors corresponding to the two alarm data in each dimension is determined respectively; a preset first weight mapping relationship and a second weight mapping relationship are obtained, wherein, in the first weight mapping relationship, the weight corresponding to the feature vector of the spatial dimension is greater than the weight corresponding to the feature vector of the fault professional dimension, and in the second weight mapping relationship, the weight corresponding to the feature vector of the fault professional dimension is greater than the weight corresponding to the feature vector of the spatial dimension; the cosine similarities in multiple dimensions are weightedly summed according to the first weight mapping relationship to obtain the first text similarity between the two alarm data; the cosine similarities in multiple dimensions are weightedly summed according to the second weight mapping relationship to obtain the second text similarity between the two alarm data.

[0082] As an optional implementation, after determining the first text similarity and the second text similarity between each two alarm data based on the feature vectors of multiple dimensions and the weights corresponding to each dimension, the following steps can also be performed: for each two alarm data, determine the difference between 1 and the first text similarity between the two alarm data as the first text distance between the two alarm data, and determine the difference between 1 and the second text similarity between the two alarm data as the second text distance between the two alarm data; construct a first text distance matrix based on multiple first text distances, and construct a second text distance matrix based on multiple second text distances.

[0083] After obtaining the first text similarity, the first clustering module performs agglomerative hierarchical clustering on multiple alarm data based on the first text similarity to obtain multiple first clusters, and determines that the first cluster including the number of alarm data exceeding the first preset threshold is the first target cluster, and generates regional large-scale alarm event prompt information based on the first target cluster.

[0084] As an optional implementation, the agglomerative hierarchical clustering of the plurality of alarm data according to the first text similarity can include the following steps: taking each alarm data in the plurality of alarm data as an independent cluster, and determining a first cluster distance matrix between the plurality of independent clusters according to the first text distance matrix, wherein the first cluster distance between any two clusters is the first text distance between the two alarm data corresponding to the two clusters; performing the following process in a loop until a preset termination condition is met: determining the smallest first cluster distance from the first cluster distance matrix, and if the first cluster distance is not greater than a preset first distance threshold, merging the two independent clusters corresponding to the smallest first cluster distance into a new cluster; updating the first cluster distance matrix according to the merging result, wherein the first cluster distance between the new cluster and any other independent cluster is the average of a plurality of first text distances between each alarm data in the new cluster and each alarm data in the other independent cluster; and determining that the loop is terminated in a case where the first cluster distance between any two clusters in the first cluster distance matrix is greater than the first distance threshold.

[0085] After obtaining the first target cluster, for each first target cluster, the second clustering module performs agglomerative hierarchical clustering on the plurality of alarm data in the first target cluster according to the second text similarity, obtains a plurality of second clusters, and determines a second target cluster including alarm data whose number exceeds a second preset threshold, and generates a single-professional large-scale alarm event prompt information according to the second target cluster.

[0086] As an optional implementation, the agglomerative hierarchical clustering of the plurality of alarm data in the first target cluster according to the second text similarity can include the following steps: taking each alarm data in the plurality of alarm data in the first target cluster as an independent cluster, and determining a second cluster distance matrix between the plurality of independent clusters according to the second text distance matrix, wherein the second cluster distance between any two clusters is the second text distance between the two alarm data corresponding to the two clusters; performing the following process in a loop until a preset termination condition is met: determining the smallest second cluster distance from the second cluster distance matrix, and if the second cluster distance is not greater than a preset second distance threshold, merging the two independent clusters corresponding to the smallest second cluster distance into a new cluster; updating the second cluster distance matrix according to the merging result, wherein the second cluster distance between the new cluster and any other independent cluster is the average of a plurality of second text distances between each alarm data in the new cluster and each alarm data in the other independent cluster; and determining that the loop is terminated in a case where the second cluster distance between any two clusters in the second cluster distance matrix is greater than the second distance threshold.

[0087] It should be noted that each module in the fault alarm management device in the embodiment of the present application corresponds one-to-one to each implementation step of the fault alarm management method in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be elaborated here.

[0088] Example 3

[0089] According to an embodiment of the present application, a computer program product is further provided. The computer program product includes a computer program, wherein when the computer program is executed by a processor, the fault alarm management method in Example 1 is implemented.

[0090] According to an embodiment of the present application, a non-volatile storage medium is further provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the fault alarm management method in Example 1 by running the computer program.

[0091] According to an embodiment of the present application, a processor is further provided, which is used to run a computer program, wherein the fault alarm management method in Example 1 is executed when the computer program is running.

[0092] According to an embodiment of the present application, an electronic device is further provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the fault alarm management method in Example 1 through the computer program.

[0093] Specifically, the computer program executes the following steps when it is running: obtaining multiple alarm data within a target time period, and determining feature vectors of multiple dimensions corresponding to each alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension; determining a first text similarity and a second text similarity between each two alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein, when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension; performing agglomerative hierarchical clustering on the multiple alarm data based on the first text similarity to obtain multiple first clusters, and determining a first cluster including alarm data whose number exceeds a first preset threshold as a first target cluster, and generating regional large-scale alarm event prompt information based on the first target cluster; for each first target cluster, performing agglomerative hierarchical clustering on the multiple alarm data in the first target cluster based on the second text similarity to obtain multiple second clusters, and determining a second cluster including alarm data whose number exceeds a second preset threshold as a second target cluster, and generating single-professional large-scale alarm event prompt information based on the second target cluster.

[0094] As an optional implementation, the electronic device can exist in the form of a mobile terminal, a computer terminal, or a similar computing device. Figure 6 A hardware structure block diagram of an electronic device for implementing the fault alarm management method is shown. As shown in Figure 6 The electronic device 60 can include one or more processors 602 (the processor 602 can include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 604 for storing data, and a transmission device 606 for communication functions. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports in the BUS bus), a network interface, a power supply and / or a camera. Those skilled in the art can understand that Figure 6 The structure shown is only schematic, which does not limit the structure of the above-mentioned electronic device. For example, the electronic device 60 can include more or fewer components than those shown in Figure 6 or have a different configuration than that shown in Figure 6 .

[0095] It should be noted that the one or more processors 602 and / or other data processing circuits described above can be referred to herein as "data processing circuits" in general. The data processing circuit can be embodied in whole or in part as software, hardware, firmware or any other combination. In addition, the data processing circuit can be a single independent processing module, or all or part of any one of the other elements combined into the electronic device 60. As referred to in the embodiments of the present application, the data processing circuit serves as a processor control (for example, selection of a variable resistance terminal path connected to an interface).

[0096] The memory 604 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the fault alarm management method in the embodiments of the present application. The processor 602 executes various functional applications and data processing by running the software programs and modules stored in the memory 604, that is, implements the vulnerability detection method of the application program described above. The memory 604 can include a high-speed random access memory, and can also include a non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, the memory 604 can further include a memory remotely disposed with respect to the processor 602, which can be connected to the electronic device 60 through a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0097] The transmission device 606 is used to receive or send data via a network. Specific examples of the aforementioned network may include a wireless network provided by the communications provider of the electronic device 60. In one embodiment, the transmission device 606 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 606 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0098] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 60 .

[0099] The serial numbers of the above embodiments are for description only and do not represent the advantages or disadvantages of the embodiments.

[0100] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0101] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0102] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0103] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0104] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code.

[0105] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A fault alarm management method, characterized in that: include: Acquire multiple alarm data within a target time period, and determine feature vectors of multiple dimensions corresponding to each of the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault-specific dimension; Determining a first text similarity and a second text similarity between each two pieces of the alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein, when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension, and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension; performing agglomerative hierarchical clustering on the plurality of alarm data based on the first text similarity to obtain a plurality of first clusters, determining a first cluster including alarm data having a number exceeding a first preset threshold as a first target cluster, and generating regional large-scale alarm event prompt information based on the first target cluster; For each of the first target clusters, agglomerative hierarchical clustering is performed on the multiple alarm data in the first target cluster based on the second text similarity to obtain multiple second clusters, and the second cluster including the number of alarm data exceeding the second preset threshold is determined as the second target cluster, and single-professional large-scale alarm event prompt information is generated based on the second target cluster.

2. The method according to claim 1, characterized in that Get multiple alarm data within the target time period, including: A sliding time window is used to determine a time window including the current moment and a historical time period of a preset length before the current moment as the target time period, and multiple alarm data within the target time period are obtained.

3. The method according to claim 1, characterized in that Determining the feature vectors of multiple dimensions corresponding to each of the alarm data includes: For each alarm data, determining target fields of multiple dimensions in the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault-specific dimension, the spatial dimension includes at least one of the following: an alarm area dimension, and an alarm sub-area dimension under the alarm area, and the fault-specific dimension includes at least one of the following: an alarm name dimension, an alarm device name dimension, and an alarm device location information dimension; For each dimension, a pre-trained word vector model is used to determine the word embedding vector corresponding to the target field of the dimension, and the word frequency and inverse document frequency corresponding to the target field of the dimension are counted, and the product of the word frequency, the inverse document frequency and the word embedding vector is used as the feature vector of the dimension.

4. The method according to claim 1, wherein Determining a first text similarity and a second text similarity between each two pieces of the warning data according to the feature vectors of the multiple dimensions and the weight corresponding to each dimension includes: For each pair of alarm data, respectively determine the cosine similarity between the two feature vectors corresponding to the two alarm data in each dimension; Obtain a preset first weight mapping relationship and a second weight mapping relationship, wherein, in the first weight mapping relationship, the weight corresponding to the feature vector of the spatial dimension is greater than the weight corresponding to the feature vector of the fault professional dimension, and in the second weight mapping relationship, the weight corresponding to the feature vector of the fault professional dimension is greater than the weight corresponding to the feature vector of the spatial dimension; Performing weighted summation on the cosine similarities under multiple dimensions according to the first weight mapping relationship to obtain the first text similarity between the two alarm data; The cosine similarities in multiple dimensions are weighted and summed according to the second weight mapping relationship to obtain the second text similarity between the two alarm data.

5. The method according to claim 1, wherein After determining the first text similarity and the second text similarity between every two pieces of the warning data according to the feature vectors of the multiple dimensions and the weight corresponding to each dimension, the method further includes: For every two warning data, determining the difference between 1 and the first text similarity between the two warning data as the first text distance between the two warning data, and determining the difference between 1 and the second text similarity between the two warning data as the second text distance between the two warning data; A first text distance matrix is ​​constructed according to the plurality of first text distances, and a second text distance matrix is ​​constructed according to the plurality of second text distances.

6. The method according to claim 5, characterized in that Performing agglomerative hierarchical clustering on the plurality of alarm data according to the first text similarity includes: Taking each of the plurality of alarm data as an independent cluster, and determining a first cluster distance matrix between the plurality of independent clusters based on the first text distance matrix, wherein the first cluster distance between any two clusters is the first text distance between two alarm data corresponding to the two clusters; The following process is executed repeatedly until the preset termination condition is met: determining a minimum first cluster distance from the first cluster distance matrix, and if the first cluster distance is not greater than a preset first distance threshold, merging two independent clusters corresponding to the minimum first cluster distance into a new cluster; updating the first cluster distance matrix according to the merging result, wherein the first cluster distance between the new cluster and any other independent cluster is an average of multiple first text distances between each alarm data in the new cluster and each alarm data in the other independent cluster; When the first cluster distance between any two clusters in the first cluster distance matrix is ​​greater than the first distance threshold, it is determined that the loop is terminated.

7. The method according to claim 5, characterized in that Performing agglomerative hierarchical clustering on the plurality of alarm data in the first target cluster according to the second text similarity includes: Treating each of the plurality of alarm data in the first target cluster as an independent cluster, and determining a second cluster distance matrix between the plurality of independent clusters based on the second text distance matrix, wherein the second cluster distance between any two clusters is the second text distance between the two alarm data corresponding to the two clusters; The following process is executed repeatedly until the preset termination condition is met: determining a minimum second cluster distance from the second cluster distance matrix, and if the second cluster distance is not greater than a preset second distance threshold, merging two independent clusters corresponding to the minimum second cluster distance into a new cluster; updating the second cluster distance matrix according to the merging result, wherein the second cluster distance between the new cluster and any other independent cluster is an average of multiple second text distances between each alarm data in the new cluster and each alarm data in the other independent cluster; When the second cluster distance between any two clusters in the second cluster distance matrix is ​​greater than the second distance threshold, it is determined that the loop is terminated.

8. A fault alarm management device, characterized in that: include: An acquisition module is used to acquire multiple alarm data within a target time period and determine a feature vector of multiple dimensions corresponding to each of the alarm data, wherein the multiple dimensions include: a spatial dimension and a fault professional dimension; a similarity determination module, configured to determine a first text similarity and a second text similarity between each pair of the alarm data based on the feature vectors of the multiple dimensions and the weights corresponding to each dimension, wherein, when determining the first text similarity, the weight of the feature vector of the spatial dimension is greater than the weight of the feature vector of the fault professional dimension; and when determining the second text similarity, the weight of the feature vector of the fault professional dimension is greater than the weight of the feature vector of the spatial dimension; a first clustering module, configured to perform agglomerative hierarchical clustering on the plurality of alarm data based on the first text similarity to obtain a plurality of first clusters, determine a first cluster including alarm data exceeding a first preset threshold as a first target cluster, and generate regional large-scale alarm event prompt information based on the first target cluster; The second clustering module is used to perform agglomerative hierarchical clustering on the multiple alarm data in the first target cluster according to the second text similarity for each of the first target clusters to obtain multiple second clusters, and determine that the second cluster including the number of alarm data exceeding the second preset threshold is the second target cluster, and generate single-professional large-scale alarm event prompt information based on the second target cluster.

9. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, the fault alarm management method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the fault alarm management method according to any one of claims 1 to 7 through the computer program.

Images