Process alarm optimization and disposal method and device based on word vector alarm clustering

Abstract

The invention belongs to the field of artificial intelligence, and relates to a process alarm optimization and disposal method and device based on word vector alarm clustering, and the method comprises the steps: obtaining alarm data; pre-processing the alarm data; a word embedding model is adopted to vectorize the preprocessed alarm data, words in each alarm message are converted into vectors, all word vectors in the same alarm message are merged, and vector representation of the alarm messages is formed; processing the vector representation; constructing a similarity matrix, and clustering the processed vector representation; and according to a clustering result, an alarm process is optimized. Potential modes in alarm data can be automatically mined, and the intelligent level of alarm processing is improved; manual intervention is reduced, and the operation cost is reduced; the alarm process is optimized, and the response speed and accuracy are improved; data support is provided for continuous optimization of an alarm system, and alarm management is promoted to develop towards a more refined and intelligent direction.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a process alarm optimization and handling method and device based on word vector alarm clustering. Background Art

[0002] In modern industrial production, large and complex industrial processes such as oil refining play a vital role. However, these processes are often highly dangerous, including high temperature and pressure, flammable and explosive, toxic and harmful, etc. Once a failure or accident occurs, it may cause huge economic losses and casualties. In order to ensure the safe and stable operation of industrial production, alarm systems are usually used to monitor abnormal conditions in industrial processes and issue alarms in time to remind operators to take necessary measures. However, traditional alarm systems often face some challenges when facing large and complex industrial processes. As industrial alarm systems become increasingly complex, the number of alarms increases dramatically, which poses a huge challenge to the decision-making ability and timely response of operators. Effective alarm management is crucial to timely identify and handle critical alarms, prevent alarm flooding, and improve the safety and reliability of industrial systems. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides a process alarm optimization and handling method based on word vector alarm clustering, which adopts the following technical solution, including: Get alarm data; Preprocessing the alarm data; A word embedding model is used to vectorize the preprocessed alarm data, convert the words in each alarm message into a vector, and merge all the word vectors in the same alarm message to form a vector representation of the alarm message; processing the vector representation; Constructing a similarity matrix to cluster the processed vector representations; According to the clustering results, the alarm process is optimized.

[0004] Preferably, the step of obtaining alarm data specifically includes: Select the data source; The alarm data is collected according to the selected data source.

[0005] Preferably, the step of preprocessing the alarm data specifically includes: Divide the alarm log to obtain the alarm sequence; identifying a chattering alarm according to the alarm sequence; Performing alarm fusion on the chattering alarm to obtain a fused alarm sequence; Perform feature extraction on the fused alarm sequence.

[0006] Preferably, the step of using a word embedding model to vectorize the preprocessed alarm data, converting the words in each alarm message into vectors, and merging all word vectors in the same alarm message to form a vector representation of the alarm message specifically includes: Using a word embedding model to vectorize the words in the preprocessed alarm data; Aggregate the word vectors in each alarm message into an overall alarm message vector; Perform weighted averaging of word vectors according to preset weights; Normalize the vector of alarm messages; Convert each alarm message into a vector representation of fixed dimension.

[0007] Preferably, the step of processing the vector representation specifically includes: A dimensionality reduction process is performed on the vector representation.

[0008] Preferably, the step of constructing a similarity matrix and clustering the processed vector representations specifically includes: Calculate the similarity between each pair of alarm message vectors and construct a similarity matrix to measure the similarity between different vectors; Use the similarity matrix to construct the Laplacian matrix; Compute the eigenvalues ​​and eigenvectors of the Laplacian matrix; Cluster the feature vectors to obtain clusters of alarm messages.

[0009] Preferably, the step of optimizing the alarm process according to the clustering result specifically includes: Eliminate and optimize redundant alarms based on clustering results; According to the clustering results, set the alarm priority; Analyze the root cause of the alarm and locate the alarm problem.

[0010] In order to solve the above technical problems, the present invention also provides a process alarm optimization and handling device based on word vector alarm clustering, which adopts the following technical solution, including: Acquisition module, used to acquire alarm data; A preprocessing module, used for preprocessing the alarm data; A vectorization module, used for adopting a word embedding model to vectorize the preprocessed alarm data, converting the words in each alarm message into vectors, and merging all word vectors in the same alarm message to form a vector representation of the alarm message; A processing module, used for processing the vector representation; A clustering module, used for constructing a similarity matrix and clustering the processed vector representations; The optimization module is used to optimize the alarm process according to the clustering results.

[0011] Compared with the prior art, the present invention has the following beneficial effects: Implementing this embodiment has the following beneficial effects: (1) By using word vectors to convert alarm messages into mathematical representations, the semantic information in the alarm text is captured. This allows alarm information to be compared and clustered at the semantic level, surpassing traditional rule-based processing methods and being able to discover hidden alarm associations and patterns. It can more accurately identify semantically similar alarms and avoid misjudgments or omissions that may result from clustering based on a single feature (such as device status, timestamp, etc.); (2) Use clustering algorithms to classify similar alarm messages according to their semantics and context. Clustering can be used to merge multiple alarms related to the same root cause, reducing the number of redundant alarms. This improves the response efficiency of the alarm system, allowing the system to prioritize important alarms, avoid information flooding, and reduce the workload of operators.

[0012] (3) It can automatically mine potential patterns in alarm data and improve the intelligence level of alarm processing; reduce manual intervention and lower operating costs; optimize the alarm process and improve response speed and accuracy; at the same time, provide data support for the continuous optimization of the alarm system and promote the development of alarm management in a more refined and intelligent direction. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the scheme in the present invention, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present invention. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0014] Figure 1 It is a flow chart of an embodiment of a process alarm optimization and handling method based on word vector alarm clustering of the present invention; Figure 2 It is a structural schematic diagram of an embodiment of a process alarm optimization and handling device based on word vector alarm clustering of the present invention; Figure 3 It is a schematic structural diagram of an embodiment of a computer device of the present invention. DETAILED DESCRIPTION

[0015] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present invention; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present invention or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0016] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0017] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings.

[0018] It should be noted that the process alarm optimization and handling method based on word vector alarm clustering provided in the embodiment of the present invention is generally executed by a server / terminal device, and accordingly, the process alarm optimization and handling device based on word vector alarm clustering is generally arranged in a server / terminal device.

[0019] It should be understood that the number of terminal devices, networks and servers is only illustrative. Depending on the implementation requirements, there can be any number of terminal devices, networks and servers.

[0020] Example 1: Please refer to Figure 1 , shows a flow chart of an embodiment of a process alarm optimization and handling method based on word vector alarm clustering of the present invention. The process alarm optimization and handling method based on word vector alarm clustering includes the following steps: Step S1, obtaining alarm data.

[0021] In this embodiment, the electronic device (e.g., server / terminal device) on which the process alarm optimization and disposal method based on word vector alarm clustering is running can receive the process alarm optimization and disposal request based on word vector alarm clustering through a wired connection or a wireless connection. It should be noted that the above wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAXX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0022] In this embodiment, step S1, obtaining alarm data may specifically include the following steps: S11, select a data source.

[0023] Alarm data comes from various monitoring systems and log systems, for example, alarm logs of power monitoring systems, security alarms of network monitoring systems, performance alarms of database monitoring systems, etc. When determining the data source, it is necessary to clarify the type and scope of the monitored object to ensure the comprehensiveness and accuracy of the data.

[0024] For example, the data source of the alarm data can be selected according to actual needs.

[0025] S12, collecting alarm data according to the selected data source.

[0026] Collecting alarm data refers to the process of extracting alarm information from the data source. Alarm data is stored in a database, log file, or event recording system. For real-time monitoring systems, collecting alarm data can be achieved through API interfaces or message queues to ensure that alarm information can be transmitted to the processing system in real time. For log systems, alarm data can be obtained through file reading, database query, etc.

[0027] For example, you can use the system's built-in monitoring tools, such as Zabbix, Nagios, etc., to collect alarm information at the hardware and software levels.

[0028] You can also use log collection tools such as ELK Stack (Elasticsearch, Logstash, Kibana) or Splunk to collect alarm information from application and system logs.

[0029] You can also obtain event alarm data from event management systems (such as IBM Tivoli or HP OpenView).

[0030] Collect alarm data through multiple channels to ensure that all possible alarm sources are covered. Real-time monitoring tools can capture alarm information immediately and improve response speed.

[0031] Step S2, pre-processing the alarm data.

[0032] In this embodiment, step S2, pre-processing the alarm data may specifically include the following steps: S21, divide the alarm log to obtain the alarm sequence.

[0033] Traverse the alarm log and compare the time intervals between adjacent alarms. Set the time interval according to actual needs. If the time interval exceeds the set threshold, the two alarms are considered to belong to different alarm sequences. In this way, the original alarm log is divided into multiple shorter alarm sequences, and the alarms within each sequence are considered to be potentially related.

[0034] In some optional implementations of this embodiment, irrelevant characters may be removed from the alarm data, timestamps may be standardized, log entries may be formatted, and the like may be performed.

[0035] S22, identifying a chattering alarm according to the alarm sequence.

[0036] In each alarm sequence, three or more alarm events within one minute are identified. These events are considered chattering alarms and usually indicate a short-term anomaly of the system or redundant alarms.

[0037] By introducing short-term fluctuation analysis and time window filtering mechanisms, short-term frequent alarms caused by system status fluctuations or occasional failures can be automatically identified and suppressed. By setting dynamic thresholds or using time window analysis (such as merging multiple triggers of the same alarm into one alarm within 1 minute), the time and accuracy of alarm response can be optimized.

[0038] By using the time window filtering mode and alarm frequency analysis method, similar alarm events that are frequently triggered in a short period of time can be automatically merged, reducing the impact of chattering alarms caused by fluctuations and improving the response efficiency of the system. By analyzing the alarm frequency and volatility, the alarm triggering conditions can be flexibly set to avoid excessive response caused by short-term fluctuations.

[0039] Through step S22, the chattering alarm can be suppressed and the response time and accuracy of the alarm system can be optimized.

[0040] S23, performing alarm fusion on the chattering alarm to obtain a fused alarm sequence.

[0041] Alarm signals are a key source of information in information system security management and operation and maintenance. However, due to the complexity of the system and the huge amount of data, alarm signals often have problems such as redundancy, noise, and inconsistency. These problems not only increase the workload of operation and maintenance personnel, but may also cover up important alarm information, leading to response delays and increased system risks. Therefore, optimizing the processing of alarm signals, reducing unnecessary alarms, and improving the accuracy and availability of alarm signals are important means to improve system stability and security.

[0042] Fuse the alarms identified as chattering into one alarm event. The fusion can be performed by retaining the timestamp of the first alarm and merging the alarm information. The fused alarm should contain the key information of the original chattering alarm while removing duplicate and redundant content.

[0043] S24, extracting features from the fused alarm sequence.

[0044] For the fused alarm sequence, features that are helpful for subsequent clustering and analysis are extracted, such as alarm type, occurrence frequency, duration, level, timestamp, source IP address, target IP address, etc.

[0045] Through feature extraction, key features can be extracted to ensure that subsequent word vectorization can capture the core information of the alarm signal. High-dimensional alarm data can also be converted into low-dimensional feature vectors to reduce computational complexity.

[0046] Step S3, using a word embedding model to vectorize the preprocessed alarm data, converting the words in each alarm message into vectors, and merging all word vectors in the same alarm message to form a vector representation of the alarm message.

[0047] In this embodiment, step S3, using a word embedding model to vectorize the preprocessed alarm data, converting the words in each alarm message into vectors, and merging all word vectors in the same alarm message to form a vector representation of the alarm message may specifically include the following steps: S31, using a word embedding model to vectorize words in the preprocessed alarm data.

[0048] Each word in an alarm message needs to be converted into a vector representation of a fixed dimension. This process can be achieved using a word embedding model. Suppose an alarm message contains multiple words , use a word embedding model (such as Word2Vec) for each word Generate a vector representation : ; in, yes The vector representation in the word embedding space is usually a high-dimensional vector (for example, 300 dimensions). These vector representations capture the semantic information of the word.

[0049] S32, aggregating the word vectors in each alarm message into an overall alarm message vector.

[0050] Aggregate word vectors and aggregate the word vectors in each alarm message into an overall alarm message vector. Take the average vector for an alarm message , the vector representation of the alarm message can be obtained by averaging the word vectors of all words: ; in, It is an alarm message The vector representation of is the number of words in the alarm message, is the vector representation of each word. This formula converts the text information of each alarm message into a vector of fixed dimension.

[0051] S33, performing weighted averaging on the word vectors according to preset weights.

[0052] In order to better represent the semantics of the alarm message, the word vectors can be weighted averaged according to certain weights. For example, different weights can be assigned to words using term frequency (TF) or term frequency-inverse document frequency (TF-IDF).

[0053] ; in, It is The weight of a word can be calculated using the word frequency Or TF-IDF weight. This weighted average method can increase the weight of common or important words, so that the representation of the alarm message is more accurate.

[0054] S34, normalizing the vector of the alarm message.

[0055] In order to make the vector representation of the alarm message comparable under the same standard, the vector of the alarm message is normalized. , we can normalize it by the following formula: ; in, is a vector The Euclidean norm of is calculated as: ; in, is the dimension of the vector, It is Through normalization, the vectors of all alarm messages will have the same scale, which is beneficial for subsequent clustering operations.

[0056] S35, converting each alarm message into a vector representation of a fixed dimension.

[0057] After the above steps, the alarm data vectorization process converts each alarm message into a fixed-dimensional vector representation, and finally obtains the vectorization result. These vectors can be directly input into the subsequent clustering algorithm for processing.

[0058] Step S4, processing the vector representation.

[0059] In this embodiment, step S4, processing the vector representation may specifically include the following steps: S41, performing dimensionality reduction processing on the vector representation.

[0060] The vector representation of alarm messages usually has high dimensions, and direct clustering calculation will consume a lot of computing resources. Therefore, vector dimensionality reduction is required.

[0061] Principal component analysis (PCA) can be used to reduce the dimensionality of the vector representation. PCA is a commonly used dimensionality reduction method that projects high-dimensional data into a low-dimensional space through linear transformation while retaining the original information of the data as much as possible.

[0062] We can also use t-SNE to reduce the dimensionality of the vector representation. t-SNE is a nonlinear dimensionality reduction method that is particularly suitable for the visualization of high-dimensional data. It maps high-dimensional data to a low-dimensional space so that similar data points are closer in the low-dimensional space and dissimilar data points are farther apart.

[0063] Step S5, constructing a similarity matrix and clustering the processed vector representations.

[0064] In this embodiment, step S5, constructing a similarity matrix, and clustering the processed vector representations may specifically include the following steps: S51, calculating the similarity between each pair of alarm message vectors, and constructing a similarity matrix to measure the similarity between different vectors.

[0065] Similarity calculation,The similarity metric is cosine similarity, which is used to measure the similarity between two vectors. and , the cosine similarity can be expressed as: ; in: and is the vector representation of the two alarm messages, and is their Euclidean norm.

[0066] This cosine similarity can be used to calculate the similarity between all alarm messages and construct a similarity matrix , where the matrix elements Indicates an alarm message and alarm messages The similarity between: .

[0067] S52, constructing a Laplacian matrix using the similarity matrix.

[0068] Each alarm message is a node in the graph, and the similarity between alarm messages represents the weight of the edge between nodes.

[0069] First, construct the degree matrix , which is a diagonal matrix where each diagonal element Representation Node The degree of the node The sum of similarities with all other nodes: .

[0070] Laplacian matrix, construct the Laplacian matrix , which is obtained by the difference between the degree matrix and the similarity matrix: .

[0071] in: is the Laplacian matrix, which is a symmetric matrix that reflects the structure of the graph. is the similarity matrix, is the degree matrix.

[0072] S53, calculating the eigenvalues ​​and eigenvectors of the Laplacian matrix.

[0073] Compute the eigenvalues ​​and eigenvectors of the Laplacian matrix, which will provide the basis for clustering.

[0074] Eigenvalue decomposition: By decomposing the Laplacian matrix Perform eigenvalue decomposition and obtain the eigenvalue and the corresponding eigenvector .

[0075] .

[0076] Among them, the eigenvalue represents the natural frequency of the Laplace matrix, the eigenvector Then it represents the corresponding oscillation mode. The eigenvectors with smaller eigenvalues ​​are selected, which reflect the structure of the cluster in the graph.

[0077] Before selection Feature vectors: according to the number of clusters required , choose the Laplacian matrix Before These eigenvectors are combined into a matrix : .

[0078] in, is the Laplace matrix corresponding to the front feature vectors.

[0079] S54, clustering the feature vectors to obtain clusters of alarm messages.

[0080] Before choosing feature vectors to cluster the alarm messages into A cluster.

[0081] First initialize the cluster center: randomly select The initial cluster centers.

[0082] Second, assign clusters: according to the distance between each data point (feature vector) and the cluster center, assign it to the nearest cluster center.

[0083] Then the cluster centers are updated, the mean of all points within each cluster is calculated, and the cluster centers are updated.

[0084] Finally, the steps of assigning clusters and updating cluster centers are repeated until the cluster center no longer changes or the maximum number of iterations is reached.

[0085] For each data point , clusters are assigned based on distance calculation, and the algorithm update formula is: .

[0086] in, It is a cluster center.

[0087] The formula for updating the center of each cluster is: .

[0088] in, It is a cluster All points in .

[0089] Step S6, optimizing the alarm process according to the clustering results.

[0090] In this embodiment, step S6, optimizing the alarm process according to the clustering result may specifically include the following steps: S61, eliminating and optimizing redundant alarms according to the clustering results.

[0091] Based on the clustering results, you can identify which alarms belong to the same category. Alarms may overlap in time or reflect the same potential problem between different alarms, causing redundancy. Alarms belonging to the same category are merged to eliminate duplicate alarms.

[0092] S62, setting the alarm priority according to the clustering result.

[0093] In the clustering results, each cluster represents a type of alarm. By analyzing the alarm frequency, duration, and historical occurrence of each cluster, each alarm cluster is assigned a priority. Alarms with high frequency and long duration have higher priority, and operators need to handle these alarms first.

[0094] S63: Analyze the root cause of the alarm and locate the alarm problem.

[0095] Cluster analysis can reveal potential associations between multiple alarms, which may point to a common root cause. For example, some alarm sequences may be caused by factors such as equipment failure and electrical problems. Based on the alarm clusters, the common characteristics of the alarms in each cluster can be further analyzed to identify the root cause of the alarm. For example, the source of the fault can be determined by means of time sequence and similarity of alarm content. For alarms of equipment failure, the specific equipment or link can be quickly identified by combining data such as equipment operating status and historical maintenance records.

[0096] The system will record the processing and results of each alarm, and these data can be used to optimize the alarm management strategy in the future. For example, the alarm priority can be adjusted and the alarm rules can be optimized based on the timeliness and response accuracy of each alarm processing.

[0097] Through this optimization process, the entire alarm system will be more intelligent and accurate, and will be able to better adapt to dynamic changes in complex industrial production environments, thereby improving the safety and efficiency of the industrial production process.

[0098] Implementing this embodiment has the following beneficial effects: (1) By using word vectors to convert alarm messages into mathematical representations, the semantic information in the alarm text is captured. This allows alarm information to be compared and clustered at the semantic level, surpassing traditional rule-based processing methods and being able to discover hidden alarm associations and patterns. It can more accurately identify semantically similar alarms and avoid misjudgments or omissions that may result from clustering based on a single feature (such as device status, timestamp, etc.); (2) Use clustering algorithms to classify similar alarm messages according to their semantics and context. Clustering can be used to merge multiple alarms related to the same root cause, reducing the number of redundant alarms. This improves the response efficiency of the alarm system, allowing the system to prioritize important alarms, avoid information flooding, and reduce the workload of operators.

[0099] (3) It can automatically mine potential patterns in alarm data and improve the intelligence level of alarm processing; reduce manual intervention and lower operating costs; optimize the alarm process and improve response speed and accuracy; at the same time, provide data support for the continuous optimization of the alarm system and promote the development of alarm management in a more refined and intelligent direction.

[0100] The present invention can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0101] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0102] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0103] Example 2: Further reference Figure 2 , as a response to the above Figure 1 The present invention provides an embodiment of a process alarm optimization and handling device based on word vector alarm clustering, and the device embodiment is similar to Figure 1 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0104] like Figure 2 As shown, the process alarm optimization and handling device 70 based on word vector alarm clustering in this embodiment includes: an acquisition module 71, a preprocessing module 72, a vectorization module 73, a processing module 74, a clustering module 75 and an optimization module 76. Among them: An acquisition module 71, used for acquiring alarm data; A preprocessing module 72, used for preprocessing the alarm data; A vectorization module 73, configured to use a word embedding model to vectorize the preprocessed alarm data, convert the words in each alarm message into vectors, and merge all word vectors in the same alarm message to form a vector representation of the alarm message; A processing module 74, for processing the vector representation; A clustering module 75, for constructing a similarity matrix and clustering the processed vector representations; The optimization module 76 is used to optimize the alarm process according to the clustering results.

[0105] Implementing this embodiment has the following beneficial effects: (1) By using word vectors to convert alarm messages into mathematical representations, the semantic information in the alarm text is captured. This allows alarm information to be compared and clustered at the semantic level, surpassing traditional rule-based processing methods and being able to discover hidden alarm associations and patterns. It can more accurately identify semantically similar alarms and avoid misjudgments or omissions that may result from clustering based on a single feature (such as device status, timestamp, etc.); (2) Use clustering algorithms to classify similar alarm messages according to their semantics and context. Clustering can be used to merge multiple alarms related to the same root cause, reducing the number of redundant alarms. This improves the response efficiency of the alarm system, allowing the system to prioritize important alarms, avoid information flooding, and reduce the workload of operators.

[0106] (3) It can automatically mine potential patterns in alarm data and improve the intelligence level of alarm processing; reduce manual intervention and lower operating costs; optimize the alarm process and improve response speed and accuracy; at the same time, provide data support for the continuous optimization of the alarm system and promote the development of alarm management in a more refined and intelligent direction.

[0107] Embodiment 3: To solve the above technical problems, the embodiment of the present invention also provides a computer device. Figure 3 , Figure 3 This is a basic structural block diagram of the computer device in this embodiment.

[0108] The above-mentioned computer device 8 includes a memory 81, a processor 82, and a network interface 83 that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device 8 having components of a memory 81, a processor 82, and a network interface 83, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to a microprocessor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital processor (DSP), an embedded device, etc.

[0109] The computer device may be a desktop computer, a notebook computer, a PDA, a cloud server, etc. The computer device may interact with the user through a keyboard, a mouse, a remote control, a touch pad, or a voice control device.

[0110] The memory 81 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 81 may be an internal storage unit of the computer device 8, such as a hard disk or memory of the computer device 8. In other embodiments, the memory 81 may also be an external storage device of the computer device 8, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. equipped on the computer device 8. Of course, the memory 81 may also include both the internal storage unit of the computer device 8 and its external storage device. In this embodiment, the memory 81 is generally used to store the operating system and various application software installed on the computer device 8, such as computer-readable instructions of a process alarm optimization and disposal method based on word vector alarm clustering, etc. In addition, the memory 81 can also be used to temporarily store various types of data that have been output or are to be output.

[0111] In some embodiments, the processor 82 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips. The processor 82 is generally used to control the overall operation of the computer device 8. In this embodiment, the processor 82 is used to run the computer-readable instructions stored in the memory 81 or process data, such as running the computer-readable instructions of the process alarm optimization and handling method based on word vector alarm clustering.

[0112] The network interface 83 may include a wireless network interface or a wired network interface. The network interface 83 is generally used to establish a communication connection between the computer device 8 and other electronic devices.

[0113] Implementing this embodiment has the following beneficial effects: (1) By using word vectors to convert alarm messages into mathematical representations, the semantic information in the alarm text is captured. This allows alarm information to be compared and clustered at the semantic level, surpassing traditional rule-based processing methods and being able to discover hidden alarm associations and patterns. It can more accurately identify semantically similar alarms and avoid misjudgments or omissions that may result from clustering based on a single feature (such as device status, timestamp, etc.); (2) Use clustering algorithms to classify similar alarm messages according to their semantics and context. Clustering can be used to merge multiple alarms related to the same root cause, reducing the number of redundant alarms. This improves the response efficiency of the alarm system, allowing the system to prioritize important alarms, avoid information flooding, and reduce the workload of operators.

[0114] (3) It can automatically mine potential patterns in alarm data and improve the intelligence level of alarm processing; reduce manual intervention and lower operating costs; optimize the alarm process and improve response speed and accuracy; at the same time, provide data support for the continuous optimization of the alarm system and promote the development of alarm management in a more refined and intelligent direction.

[0115] Example 4: The present invention also provides another implementation mode, namely, providing a computer-readable storage medium, which stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the process alarm optimization and handling method based on word vector alarm clustering as described above.

[0116] Implementing this embodiment has the following beneficial effects: (1) By using word vectors to convert alarm messages into mathematical representations, the semantic information in the alarm text is captured. This allows alarm information to be compared and clustered at the semantic level, surpassing traditional rule-based processing methods and being able to discover hidden alarm associations and patterns. It can more accurately identify semantically similar alarms and avoid misjudgments or omissions that may result from clustering based on a single feature (such as device status, timestamp, etc.); (2) Use clustering algorithms to classify similar alarm messages according to their semantics and context. Clustering can be used to merge multiple alarms related to the same root cause, reducing the number of redundant alarms. This improves the response efficiency of the alarm system, allowing the system to prioritize important alarms, avoid information flooding, and reduce the workload of operators.

[0117] (3) It can automatically mine potential patterns in alarm data and improve the intelligence level of alarm processing; reduce manual intervention and lower operating costs; optimize the alarm process and improve response speed and accuracy; at the same time, provide data support for the continuous optimization of the alarm system and promote the development of alarm management in a more refined and intelligent direction.

[0118] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the various embodiment methods of the present invention.

[0119] Obviously, the embodiments described above are only some embodiments of the present invention, rather than all embodiments. The preferred embodiments of the present invention are given in the accompanying drawings, but they do not limit the patent scope of the present invention. The present invention can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present invention more thorough and comprehensive. Although the present invention has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific embodiments, or to perform equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of the present invention, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present invention.

Claims

1. A process alarm optimization and handling method based on word vector alarm clustering, characterized in that: The steps include: Get alarm data; Preprocessing the alarm data; A word embedding model is used to vectorize the preprocessed alarm data, convert the words in each alarm message into a vector, and merge all the word vectors in the same alarm message to form a vector representation of the alarm message; processing the vector representation; Constructing a similarity matrix to cluster the processed vector representations; According to the clustering results, the alarm process is optimized.

2. The process alarm optimization and handling method based on word vector alarm clustering according to claim 1 is characterized in that: The step of obtaining alarm data specifically includes: Select the data source; The alarm data is collected according to the selected data source.

3. The process alarm optimization and handling method based on word vector alarm clustering according to claim 1 is characterized in that: The step of preprocessing the alarm data specifically includes: Divide the alarm log to obtain the alarm sequence; identifying a chattering alarm according to the alarm sequence; Performing alarm fusion on the chattering alarm to obtain a fused alarm sequence; Perform feature extraction on the fused alarm sequence.

4. The process alarm optimization and handling method based on word vector alarm clustering according to claim 1 is characterized in that: The steps of using a word embedding model to vectorize the preprocessed alarm data, converting words in each alarm message into vectors, and merging all word vectors in the same alarm message to form a vector representation of the alarm message specifically include: Using a word embedding model to vectorize the words in the preprocessed alarm data; Aggregate the word vectors in each alarm message into an overall alarm message vector; Perform weighted averaging of word vectors according to preset weights; Normalize the vector of alarm messages; Convert each alarm message into a vector representation of fixed dimension.

5. The process alarm optimization and handling method based on word vector alarm clustering according to claim 1 is characterized in that: The step of processing the vector representation specifically includes: A dimensionality reduction process is performed on the vector representation.

6. The process alarm optimization and handling method based on word vector alarm clustering according to claim 1 is characterized in that: The step of constructing a similarity matrix and clustering the processed vector representations specifically includes: Calculate the similarity between each pair of alarm message vectors and construct a similarity matrix to measure the similarity between different vectors; Use the similarity matrix to construct the Laplacian matrix; Compute the eigenvalues ​​and eigenvectors of the Laplacian matrix; Cluster the feature vectors to obtain clusters of alarm messages.

7. The process alarm optimization and handling method based on word vector alarm clustering according to any one of claims 1 to 6, characterized in that: The steps of optimizing the alarm process according to the clustering results specifically include: Eliminate and optimize redundant alarms based on clustering results; According to the clustering results, set the alarm priority; Analyze the root cause of the alarm and locate the alarm problem.

8. A process alarm optimization and handling device based on word vector alarm clustering, characterized in that: include: Acquisition module, used to acquire alarm data; A preprocessing module, used for preprocessing the alarm data; A vectorization module, used for adopting a word embedding model to vectorize the preprocessed alarm data, converting the words in each alarm message into vectors, and merging all word vectors in the same alarm message to form a vector representation of the alarm message; A processing module, used for processing the vector representation; A clustering module, used for constructing a similarity matrix and clustering the processed vector representations; The optimization module is used to optimize the alarm process according to the clustering results.

Images