Server abnormity alarm aggregation method and device based on time sequence

Abstract

The invention provides a time sequence-based server exception alarm aggregation method and device, and the method comprises the steps: collecting a historical data set of a server; classifying abnormal data in the alarm database to generate an abnormal alarm data set; calculating the sum of absolute values of time differences of the second type of alarms in the time window with the first type of alarms as the center; constructing a matrix, and calculating a similarity matrix containing time features based on the matrix; the similarity matrix is tiled, a time feature similarity matrix is generated, and the dimension of the time feature similarity matrix is the same as that of the similarity matrix; constructing and generating a multi-dimensional similarity matrix; and constructing a similarity module, forming a three-degree updating mode by the similarity module and the affinity propagation algorithm basic module, and outputting an abnormal alarm clustering result. Compared with a clustering algorithm of an existing scheme, the problem of low accuracy caused by manual errors is reduced, and the aggregation effect of the algorithm on similar data is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for aggregating abnormal server alarms based on time series. Background Art

[0002] With the rapid development of network technology, network services have gradually skyrocketed, and the number of servers has also increased year by year. Servers have a place in the road of technological development relying on powerful CPU computing power and excellent compatibility, but old and heavily loaded servers are prone to various failures. A large number of failures and downtimes make operation and maintenance management increasingly difficult.

[0003] Server fault alarms are an important source of information for operation and maintenance personnel to understand the status. Operation and maintenance personnel can locate the fault location and solve the problem in a timely manner by analyzing the alarm information. However, in the reality of a huge IT system, servers are closely connected, and a small problem may cause a series of fault alarms. These alarms may be caused by the same problem and are related to each other. A large amount of alarm information will greatly interfere with the work of operation and maintenance personnel, requiring more time to troubleshoot and solve problems, greatly reducing the efficiency of operation and maintenance.

[0004] The specific implementation details of the existing new technology are to use the time difference relationship between two alarms in the time window to construct a new relationship matrix, and then use the K-means clustering algorithm to aggregate the column vectors in the relationship matrix to obtain the final clustering result. The K-means clustering algorithm depends on the initial selection of the K value. Different K values ​​may produce different clustering results, and the accuracy of the clustering results cannot be guaranteed.

[0005] The existing new technologies have the following shortcomings:

[0006] 1) The selection of K value is difficult to control, and the error of manually customized K value is large, resulting in inaccurate clustering results;

[0007] 2) The K-means algorithm can process a limited number of data types, has poor clustering effects on high-dimensional data objects, and is not friendly to high-dimensional server data processing;

[0008] 3) The data processing process lacks calculation and analysis of the time dimension. For problems such as abnormal alarms, analysis on the time dimension is crucial because one abnormality may cause the server to generate multiple abnormal alarms within a very small time range. Summary of the invention

[0009] The present application shows a method and device for aggregating abnormal server alarms based on time series.

[0010] In a first aspect, the present application shows a method for aggregating abnormal server alarms based on time series, the method comprising:

[0011] Collecting historical data sets from the server and storing the historical data sets in an alarm database;

[0012] Based on the site category, the abnormal data in the alarm database is classified, the abnormal alarm data corresponding to the site name is obtained, and the abnormal alarm data set is generated;

[0013] Calculate the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm, wherein the first type of alarm is an alarm in the abnormal alarm data set, and the second type of alarm is an alarm within a time window centered on the first type of alarm;

[0014] Constructing a matrix based on the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm, and calculating a similarity matrix including time features based on the matrix;

[0015] Flattening the similarity matrix to generate a time feature similarity matrix, wherein the time feature similarity matrix has the same dimension as the similarity matrix;

[0016] The distance similarity matrix and the time feature similarity matrix are summed to construct a multi-dimensional similarity matrix;

[0017] The multi-dimensional similarity matrix is ​​used to construct a similarity module by calculating each unit value, and the similarity module and the basic module of the nearest neighbor propagation algorithm are combined into a three-dimensional update mode to output an abnormal alarm clustering result.

[0018] In an exemplary embodiment of the present disclosure, the method further includes:

[0019] Collect historical data sets of the server and analyze the alarm name, alarm time, alarm location and alarm description of abnormal alarm data.

[0020] In an exemplary embodiment of the present disclosure, the method further includes:

[0021] The historical data set is divided into a training set and a test set, and the ratio of the training set to the test set is 7:3.

[0022] In an exemplary embodiment of the present disclosure, the method further includes:

[0023] Based on the site category, the abnormal data in the alarm database is classified, and based on the correspondence between the site name and the abnormal alarm data in the mapping relationship of the key-value pair Key-Value, the abnormal alarm data corresponding to the site name is obtained to generate an abnormal alarm data set.

[0024] In an exemplary embodiment of the present disclosure, the method further includes:

[0025] The abnormal alarm data includes alarm data, alarm clusters, and time windows.

[0026] In an exemplary embodiment of the present disclosure, the method further includes:

[0027] Based on the preset first weight and second weight, the distance similarity matrix and the time feature similarity are weighted and summed to construct a multi-dimensional similarity matrix.

[0028] In an exemplary embodiment of the present disclosure, the method further includes:

[0029] The similarity module and the basic module of the proximity propagation algorithm form a three-degree update mode based on a preset three-degree update mode, and the preset three-degree update mode includes an attraction module, a belonging module and a similarity module.

[0030] In a second aspect, the present application shows a time-series-based server abnormality alarm aggregation device, the device comprising:

[0031] A data collection module, used to collect historical data sets from the server and store the historical data sets in an alarm database;

[0032] The data set acquisition module is used to classify the abnormal data in the alarm database based on the site category, obtain the abnormal alarm data corresponding to the site name, and generate the abnormal alarm data set;

[0033] An alarm data calculation module, used to calculate the sum of the absolute values ​​of the time differences between a first type of alarm and a second type of alarm, wherein the first type of alarm is an alarm in an abnormal alarm data set, and the second type of alarm is an alarm within a time window centered on the first type of alarm;

[0034] A similarity matrix calculation module, used to construct a matrix based on the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm, and calculate a similarity matrix containing time features based on the matrix;

[0035] A time feature generation module, used for performing a tiling process on the similarity matrix to generate a time feature similarity matrix, wherein the time feature similarity matrix has the same dimension as the similarity matrix;

[0036] A multi-dimensional construction module, used for summing the distance similarity matrix and the time feature similarity matrix to construct a multi-dimensional similarity matrix;

[0037] The three-dimensional update mode module is used to construct a similarity module by calculating each unit value of the multi-dimensional similarity matrix, and the similarity module and the basic module of the nearest neighbor propagation algorithm form a three-dimensional update mode to output the abnormal alarm clustering result.

[0038] In a third aspect, the present application shows an electronic device, which includes: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method described in any of the above aspects.

[0039] In a fourth aspect, the present application illustrates a non-temporary computer-readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute a method as described in any of the above aspects.

[0040] In a fifth aspect, the present application illustrates a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the method described in any of the above aspects.

[0041] A time series-based server abnormal alarm aggregation method of the present application includes: collecting historical data sets of servers and storing the historical data sets in an alarm database; classifying abnormal data in the alarm database based on site categories, obtaining abnormal alarm data corresponding to the site name, and generating an abnormal alarm data set; calculating the sum of the absolute values ​​of the time difference between the first type of alarm and the second type of alarm, wherein the first type of alarm is an alarm in the abnormal alarm data set, and the second type of alarm is an alarm in a time window centered on the first type of alarm; constructing a matrix based on the sum of the absolute values ​​of the time difference between the first type of alarm and the second type of alarm, and calculating a similarity matrix containing time features based on the matrix; tiling the similarity matrix to generate a time feature similarity matrix, wherein the time feature similarity matrix has the same dimension as the similarity matrix; summing the distance similarity matrix and the time feature similarity matrix to construct a multi-dimensional similarity matrix; constructing a similarity module by calculating the value of each unit of the multi-dimensional similarity matrix, forming a three-dimensional update mode with the similarity module and the basic module of the nearest neighbor propagation algorithm, and outputting the abnormal alarm clustering result. Compared with the clustering algorithm of the existing scheme, the clustering algorithm of the present invention reduces the problem of low accuracy caused by human errors, improves the algorithm's aggregation effect on similar data, solves the problems of many and diverse types of server failures, high and difficult operation and maintenance costs, and improves the operation and maintenance efficiency of the entire cloud server provider. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flowchart of the steps of a time-series-based server abnormality alarm aggregation method of the present application.

[0043] Figure 2 It is a schematic diagram of a message transmission mechanism of a time-series-based server abnormality alarm aggregation method of the present application.

[0044] Figure 3 It is a schematic diagram of a three-degree update mode of a time-series-based server abnormality alarm aggregation method of the present application.

[0045] Figure 4 This is a structural block diagram of a time-series-based server abnormality alarm aggregation device of the present application.

[0046] Figure 5 It is a block diagram of an electronic device of the present application.

[0047] Figure 6 It is a block diagram of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] k-means algorithm: an iterative clustering analysis algorithm, which divides the data into K groups in advance, randomly selects K objects as the initial cluster centers, and then calculates the distance between each object and each seed cluster center, and assigns each object to the cluster center closest to it.

[0050] Key-Value: refers to a data structure or database model that stores data in the form of key-value pairs. In this model, each data item consists of a unique key (Key) and an associated value (Value). The key is used to uniquely identify the data item, and the value is the data associated with the key.

[0051] A time series-based server abnormal alarm aggregation method of the present application includes: collecting historical data sets of servers and storing the historical data sets in an alarm database; classifying abnormal data in the alarm database based on site categories, obtaining abnormal alarm data corresponding to the site name, and generating an abnormal alarm data set; calculating the sum of the absolute values ​​of the time difference between the first type of alarm and the second type of alarm, wherein the first type of alarm is an alarm in the abnormal alarm data set, and the second type of alarm is an alarm in a time window centered on the first type of alarm; constructing a matrix based on the sum of the absolute values ​​of the time difference between the first type of alarm and the second type of alarm, and calculating a similarity matrix containing time features based on the matrix; tiling the similarity matrix to generate a time feature similarity matrix, wherein the time feature similarity matrix has the same dimension as the similarity matrix; summing the distance similarity matrix and the time feature similarity matrix to construct a multi-dimensional similarity matrix; constructing a similarity module by calculating the value of each unit of the multi-dimensional similarity matrix, forming a three-dimensional update mode with the similarity module and the basic module of the nearest neighbor propagation algorithm, and outputting the abnormal alarm clustering result. Compared with the clustering algorithm of the existing scheme, the clustering algorithm of the present invention reduces the problem of low accuracy caused by human errors, improves the algorithm's aggregation effect on similar data, solves the problems of many and diverse types of server failures, high and difficult operation and maintenance costs, and improves the operation and maintenance efficiency of the entire cloud server provider.

[0052] Embodiment 1:

[0053] Reference Figure 1 , shows a flow chart of the steps of a time-series-based server abnormality alarm aggregation method of the present application, which can be applied to electronic devices, wherein the method can specifically include the following steps:

[0054] In step S110, historical data sets of the server may be collected and stored in an alarm database.

[0055] In the embodiment of this example, the method further includes:

[0056] Collect historical data sets of the server and analyze the alarm name, alarm time, alarm location and alarm description of abnormal alarm data.

[0057] In the embodiment of this example, the method further includes:

[0058] The historical data set is divided into a training set and a test set, and the ratio of the training set to the test set is 7:3.

[0059] In step S150, the abnormal data in the alarm database may be classified based on the site category, the abnormal alarm data corresponding to the site name may be obtained, and the abnormal alarm data set may be generated.

[0060] In the embodiment of this example, the method further comprises:

[0061] Based on the site category, the abnormal data in the alarm database is classified, and based on the correspondence between the site name and the abnormal alarm data in the mapping relationship of the key-value pair Key-Value, the abnormal alarm data corresponding to the site name is obtained to generate an abnormal alarm data set.

[0062] In step S130, the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm may be calculated, wherein the first type of alarm is an alarm in the abnormal alarm data set, and the second type of alarm is an alarm within a time window centered on the first type of alarm.

[0063] In the embodiment of this example, the method further comprises:

[0064] The abnormal alarm data includes alarm data, alarm clusters, and time windows.

[0065] In step S140, a matrix may be constructed based on the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm, and a similarity matrix including time features may be calculated based on the matrix.

[0066] In step S150, the similarity matrix may be tiled to generate a time feature similarity matrix, wherein the time feature similarity matrix has the same dimension as the similarity matrix.

[0067] In step S160, the distance similarity matrix and the time feature similarity matrix may be summed to construct a multi-dimensional similarity matrix.

[0068] In the embodiment of this example, the method further comprises:

[0069] Based on the preset first weight and second weight, the distance similarity matrix and the time feature similarity are weighted and summed to construct a multi-dimensional similarity matrix.

[0070] In step S170, the multi-dimensional similarity matrix can be used to construct a similarity module by calculating each unit value, and the similarity module and the basic module of the neighbor propagation algorithm are combined into a three-dimensional update mode to output the abnormal alarm clustering result.

[0071] In the embodiment of this example, the method further comprises:

[0072] The similarity module and the basic module of the proximity propagation algorithm form a three-degree update mode based on a preset three-degree update mode, and the preset three-degree update mode includes an attraction module, a belonging module and a similarity module.

[0073] In the embodiment of this example, the server abnormal alarm aggregation method based on time series disclosed in the present invention relates to the technical field of server abnormal alarm aggregation. The present invention introduces the neighbor propagation algorithm, which is good at processing medium and high dimensional data sets, and can well process a large amount of abnormal alarm data generated by the server, and the neighbor propagation algorithm will calculate the similarity between the two data, reduce the problem of low detection accuracy caused by insufficient information, and reduce the problem of low accuracy caused by manual errors compared to the clustering algorithm of the existing scheme; the present invention calculates the time difference relationship between the two abnormal alarms in the time window, calculates the correlation between the abnormal alarms from a new perspective, and constructs a new module-TF similarity module in the neighbor propagation algorithm by calculating the time feature similarity matrix, forming a new three-dimensional update mode, integrating the time dimension information into the information transmission update process, and improving the algorithm The aggregation effect of similar data. The present invention cleverly performs weighted summation on the time feature similarity matrix and the distance similarity matrix in the neighbor propagation algorithm, and comprehensively calculates the similarity between data from different dimensions. Compared with the traditional one dimension, it has higher accuracy and improves the clustering effect. The present invention solves the problems of multiple and complex types of server failures, high and difficult operation and maintenance costs, and improves the operation and maintenance efficiency of the entire cloud server provider.

[0074] Embodiment 2:

[0075] In the embodiment of this example, the present disclosure is implemented through the following technical solutions:

[0076] The present invention provides a method for aggregating abnormal server alarms based on time series, comprising the following steps:

[0077] Step S110: Collect server historical data sets and store them in an alarm database for subsequent algorithm training;

[0078] Step S120: classify the abnormal data in the alarm database according to different sites, and obtain the corresponding abnormal alarm data set according to the site name using the Key-Value mapping relationship;

[0079] Step S130: define the relationship between abnormal alarm information and, calculate the absolute value of the time difference between the abnormal alarm data set i and the j type alarm in the time window centered on itself, denoted as Δ ij ;

[0080] Step S140: Using the Δ in step S130 ij Construct an m*m matrix and calculate the similarity matrix with time characteristics Reflects the correlation between two abnormal alarm categories;

[0081] Step S150: Flattening the similarity matrix with time characteristics in step S140 to obtain a time characteristic similarity matrix T having the same dimension as the similarity matrix S calculated based on distance by the neighbor propagation algorithm;

[0082] Step S160: Perform weighted summation of the distance similarity matrix S and the time feature similarity matrix T in step S150 to construct a multi-dimensional similarity matrix ST for subsequent iterations;

[0083] Step S170: The matrix ST obtained in step S160 is used to construct an ST similarity module by calculating each unit value, and a three-dimensional update mode is formed with the basic module of the neighbor propagation algorithm to output the final abnormal alarm clustering result.

[0084] As a preferred technical solution, the collected data set in step S110 needs to analyze the alarm name, alarm time, alarm location and alarm description corresponding to the abnormal alarm data, and divide it into a training set and a test set. The ratio of the training set to the test set is 7:3 to ensure the accuracy of the model's learning of abnormal data features.

[0085] As a preferred technical solution, the site mapping in step S120 uses the name site of each site as the key, obtains all abnormal alarm data of the site according to the mapping relationship, and forms an abnormal alarm data set {D 1 , D 2 , ..., D n}, where n is the number of datasets.

[0086] As a preferred technical solution, the mapping relationship is:

[0087] H site = <D 1 , D 2 , ..., D m >

[0088] As a preferred technical solution, the abnormal alarm information defined in step S130 includes: alarm data D, alarm cluster A, and time window W:

[0089] Alarm data D = {alarm, site, T}, wherein the alarm indicates the abnormal alarm type; the site indicates the abnormal alarm site; and T indicates the abnormal alarm time;

[0090] Alarm cluster A = {A 1 ,A 2 ,...,A n}, the A nrepresents the nth abnormal alarm data cluster in the alarm cluster A; the alarm data of the i-th alarm in the alarm cluster A is represented as {alarm i1 , alarm i2 ,...alarm in}.

[0091] Alarm time window W = {T win ,<alarm′,site,T>}, T represents the center of the time T when the abnormal alarm occurs, T win Indicates the interval of the time window.

[0092] In the alarm data D={alarm, site, T}, the start time and end time of the abnormal alarm are T respectively. start , T end , the time window is α, and the size of the alarm data set is n.

[0093] As a preferred technical solution, the m×m matrix constructed in step S140 is:

[0094]

[0095] The calculation expression of time feature similarity is:

[0096]

[0097] Where X i represents the value of the i-th dimension in X, represents the average value of all dimensions in the X column vector, Y i represents the value of the i-th dimension in Y, represents the average value of all dimensions in the Y column vector, where β represents a hyperparameter with time characteristics.

[0098] As a preferred technical solution, in step S150, the temporal similarity matrix is ​​flattened to obtain a matrix T having the same dimension as the matrix S. The calculation expression is:

[0099]

[0100] Among them, x, y represent the output matrix, and u, v represent the input matrix.

[0101] As a preferred technical solution, the weighted summation in step S160 constructs a multi-dimensional similarity matrix ST, and the weighted expression is:

[0102] ST=ω 1 S+ω 2 T

[0103] where ω 1and ω 2 are different weight parameters.

[0104] As a preferred technical solution, the step S170 constructs a three-dimensional update mode, wherein the loss function calculation expression is:

[0105]

[0106] where μ′ i represents the center of each cluster; μ represents the center of all abnormal alarm data; p represents any point in the cluster.

[0107] In the embodiment of this example, the present disclosure collects server abnormal alarm data to train a clustering algorithm, calculates the similarity between data from the time dimension, solves the problem of multiple and complex server failure types, high and difficult operation and maintenance costs, and improves the operation and maintenance efficiency of the entire cloud service provider.

[0108] Embodiment three:

[0109] In this exemplary embodiment, Figure 1 The present invention provides a flow chart of a method for aggregating abnormal server alarms based on time series, which includes the following steps:

[0110] Step S110: Collect server historical data sets and store them in an alarm database for subsequent algorithm training;

[0111] It is necessary to analyze the collected data, analyze the alarm name, alarm time, alarm location and alarm description corresponding to the abnormal alarm data, and divide them into training set and test set. The ratio of training set to test set is 7:3 to ensure the sensitivity of the model to the abnormal data characteristics.

[0112] Step S120: classify the abnormal data in the alarm database according to different sites, and obtain the corresponding abnormal alarm data set according to the site name using the Key-Value mapping relationship;

[0113] The site mapping uses the name of each site as a key, and obtains all abnormal alarm data of the site according to the mapping relationship to form an abnormal alarm data set {D 1 , D 2 , ..., D n}, where n is the number of data sets. The mapping relationship is:

[0114] H site = <D 1 , D 2 , ..., D m >

[0115] Step S130: define the relationship between abnormal alarm information and, calculate the absolute value of the time difference between the abnormal alarm data set i and the j type alarm in the time window centered on itself, denoted as Δ ij ;

[0116] The definition of abnormal alarm information includes: alarm data D, alarm cluster A, and alarm time window W:

[0117] Alarm data D = {alarm, site, T}, wherein the alarm indicates the abnormal alarm type; the site indicates the abnormal alarm site; and T indicates the abnormal alarm time;

[0118] Alarm cluster A = {A 1 , A 2 , ..., A n}, the A n represents the nth abnormal alarm data cluster in the alarm cluster A; the alarm data of the i-th alarm in the alarm cluster A is represented as {alarm i1 , alarm i2 , ..., alarm in};

[0119] Alarm time window W = {T win ,<alarm′,site,T>}, T represents the center of the time T when the abnormal alarm occurs, T win Indicates the interval of the time window;

[0120] In the alarm data D={alarm, site, T}, the start time and end time of the abnormal alarm are T respectively. start , T end , the time window is α, and the size of the alarm data set is n;

[0121] Step S140: Use the Δ_ij in step S130 to construct an m*m matrix and calculate a similarity matrix with time characteristics Reflects the correlation between two abnormal alarm categories;

[0122] The constructed m×m matrix is:

[0123]

[0124] The calculation expression of time feature similarity is:

[0125]

[0126] Where X i represents the value of the i-th dimension in X, represents the average value of all dimensions in the X column vector, Yi represents the value of the i-th dimension in Y, represents the average value of all dimensions in the Y column vector, where β represents a hyperparameter with time characteristics.

[0127] Step S150: Flattening the similarity matrix with time characteristics in step S140 to obtain a time characteristic similarity matrix T having the same dimension as the similarity matrix S calculated based on distance by the neighbor propagation algorithm;

[0128] The temporal similarity matrix is ​​flattened, and the calculation expression is:

[0129]

[0130] Among them, x, y represent the output matrix, and u, v represent the input matrix.

[0131] Step S160: Perform weighted summation of the distance similarity matrix S and the time feature similarity matrix T in step S150 to construct a multi-dimensional similarity matrix ST for subsequent iterations;

[0132] The distance similarity matrix S is a matrix of abnormal alarm data {D 1 , D 2 , ..., D n}Calculate the similarity between two data points. The expression calculated based on the Euclidean distance is:

[0133] S(i,n)=-||X i -X k || 2

[0134] The neighbor propagation algorithm message transmission mechanism includes two types, attraction information r(i, k) and attribution information a(i, k). Attraction information means that data i sends information to candidate center k, reflecting the appropriate accumulated evidence that candidate center k is suitable as the center of data i; attribution information means that candidate center k sends information to data i, reflecting the appropriate accumulated evidence that data i chooses data k as the center; Figure 2 .

[0135] The weighted summation constructs a multi-dimensional similarity matrix ST, and the weighted expression is:

[0136] ST=ω 1 S+ω 2 T

[0137] where ω 1 and ω 2 are different weight parameters.

[0138] Step S170: The matrix ST obtained in step S160 is used to construct an ST similarity module by calculating each unit value, and a three-dimensional update mode is formed with the basic module of the neighbor propagation algorithm to output the final abnormal alarm clustering result.

[0139] The three-level update mode represents the order of message passing between modules, such as Figure 3 As shown, it includes an attraction module, an affiliation module and an ST similarity module.

[0140] (1) The first step means that the attraction module receives and processes the result of the previous iteration and then transmits the result of this processing to the belonging module;

[0141] (2) The second and third steps indicate that after the attribution module has finished processing, the result data of the attraction module and the attribution module are simultaneously transmitted to the ST similarity module to obtain data with both time features and distance features;

[0142] (3) Steps 4 and 5 mean that the new data obtained in (2) and the results of the attribution processing are all passed to the attraction module. Finally, the attraction module organizes the data and continues to the next iteration until the algorithm converges.

[0143] The calculation expression during the iteration process is:

[0144]

[0145] Where a(i, k) represents the attribution matrix constructed during the information transmission process; r(i, k) represents the attraction matrix constructed during the information transmission process; st(i, k) represents the ST similarity matrix constructed during the information transmission process.

[0146] The loss function calculation expression is:

[0147]

[0148] where μ′ i represents the center of each cluster; μ represents the center of all abnormal alarm data; p represents any point in the cluster.

[0149] The clustering algorithm iteration methods can be divided into two types: (1) stopping iteration after a constant number of times; (2) ending through loss function convergence. The method of stopping iteration after a constant number of times is to adopt the most primitive control method, stop iteration after a fixed number of times, and then directly output the clustering results. To prevent data overflow during the iteration process, the present invention can use 20 iterations to conduct experiments on both the training model and the test model. The convergence through the loss function means that as the machine learning model is trained, the loss function result of the model gradually decreases until it approaches a stable state, and then the clustering results are output.

[0150] Although the clustering results obtained with the constant number of iterations can prevent data overflow during the iteration process, this method may lead to inaccurate model output results and the model may have a local optimal situation.

[0151] Combining the time feature similarity matrix and the distance similarity matrix, the clusters divided by each site are recorded, and the abnormal alarm aggregation results of different sites are queried in the Key-Value way. The cluster center selected by the algorithm in the clustering process is more appropriate, and different abnormal alarms are more clearly distinguished, which reduces the alarm frequency, reduces the work of server operation and maintenance personnel, and improves operation and maintenance efficiency.

[0152] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by the present application.

[0153] Reference Figure 4 , shows a structural block diagram of a time-series-based server abnormality alarm aggregation device of the present application, the device includes a data collection module 210, a data set acquisition module 220, an alarm data calculation module 230, a similarity matrix calculation module 240, a time feature generation module 250, a multi-dimensional construction module 260 and a three-dimensional update mode module 270:

[0154] A data collection module 210, for collecting historical data sets from the server and storing the historical data sets in an alarm database;

[0155] The data set acquisition module 220 is used to classify the abnormal data in the alarm database based on the site category, obtain the abnormal alarm data corresponding to the site name, and generate an abnormal alarm data set;

[0156] An alarm data calculation module 230 is used to calculate the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm, wherein the first type of alarm is an alarm in the abnormal alarm data set, and the second type of alarm is an alarm within a time window centered on the first type of alarm;

[0157] A similarity matrix calculation module 240, configured to construct a matrix based on the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm, and calculate a similarity matrix including time features based on the matrix;

[0158] A time feature generation module 250 is used to perform a tiling process on the similarity matrix to generate a time feature similarity matrix, wherein the time feature similarity matrix has the same dimension as the similarity matrix;

[0159] A multi-dimensional construction module 260, used to sum the distance similarity matrix and the time feature similarity matrix to construct a multi-dimensional similarity matrix;

[0160] The three-dimensional update mode module 270 is used to construct a similarity module by calculating each unit value of the multi-dimensional similarity matrix, and to form a three-dimensional update mode with the similarity module and the basic module of the nearest neighbor propagation algorithm, and output the abnormal alarm clustering result.

[0161] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0162] Optionally, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0163] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0164] Figure 5 800 is a block diagram of an electronic device 800 shown in the present application. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0165] Reference Figure 5 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0166] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0167] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, images, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0168] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0169] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0170] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0171] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0172] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the electronic device 800, and the sensor assembly 814 can also detect the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of contact between the user and the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0173] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast operation information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0174] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0175] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by a processor 820 of an electronic device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0176] Figure 6 19 is a block diagram of a computer-readable storage medium 1900 shown in the present application. For example, the computer-readable storage medium 1900 may be provided as a server.

[0177] Reference Figure 6 , the computer-readable storage medium 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0178] The computer-readable storage medium 1900 may also include a power supply component 1926 configured to perform power management of the computer-readable storage medium 1900, a wired or wireless network interface 1950 configured to connect the computer-readable storage medium 1900 to a network, and an input / output (I / O) interface 1958. The computer-readable storage medium 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0179] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0180] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0181] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0182] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0183] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0184] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0185] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0186] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0187] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0188] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for aggregating abnormal server alarms based on time series, characterized in that: The method comprises: Collecting historical data sets from the server and storing the historical data sets in an alarm database; Based on the site category, the abnormal data in the alarm database is classified, the abnormal alarm data corresponding to the site name is obtained, and the abnormal alarm data set is generated; Calculate the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm, wherein the first type of alarm is an alarm in the abnormal alarm data set, and the second type of alarm is an alarm within a time window centered on the first type of alarm; Constructing a matrix based on the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm, and calculating a similarity matrix including time features based on the matrix; Flattening the similarity matrix to generate a time feature similarity matrix, wherein the time feature similarity matrix has the same dimension as the similarity matrix; The distance similarity matrix and the time feature similarity matrix are summed to construct a multi-dimensional similarity matrix; The multi-dimensional similarity matrix is ​​used to construct a similarity module by calculating each unit value, and the similarity module and the basic module of the nearest neighbor propagation algorithm are combined into a three-dimensional update mode to output an abnormal alarm clustering result.

2. The method according to claim 1, characterized in that The method further comprises: Collect historical data sets of the server and analyze the alarm name, alarm time, alarm location and alarm description of abnormal alarm data.

3. The method according to claim 2, characterized in that The method further comprises: The historical data set is divided into a training set and a test set.

4. The method according to claim 1, characterized in that The method further comprises: Based on the site category, the abnormal data in the alarm database is classified, and based on the correspondence between the site name and the abnormal alarm data in the mapping relationship of the key-value pair Key-Value, the abnormal alarm data corresponding to the site name is obtained to generate an abnormal alarm data set.

5. The method according to claim 1, characterized in that The method further comprises: The abnormal alarm data includes alarm data, alarm clusters, and time windows.

6. The method according to claim 1, characterized in that The method further comprises: Based on the preset first weight and second weight, the distance similarity matrix and the time feature similarity are weighted and summed to construct a multi-dimensional similarity matrix.

7. The method according to claim 1, characterized in that The method further comprises: The similarity module and the basic module of the proximity propagation algorithm form a three-degree update mode based on a preset three-degree update mode, and the preset three-degree update mode includes an attraction module, a belonging module and a similarity module.

8. A server abnormality alarm aggregation device based on time series, characterized in that: The device comprises: A data collection module, used to collect historical data sets from the server and store the historical data sets in an alarm database; The data set acquisition module is used to classify the abnormal data in the alarm database based on the site category, obtain the abnormal alarm data corresponding to the site name, and generate the abnormal alarm data set; An alarm data calculation module, used to calculate the sum of the absolute values ​​of the time differences between a first type of alarm and a second type of alarm, wherein the first type of alarm is an alarm in an abnormal alarm data set, and the second type of alarm is an alarm within a time window centered on the first type of alarm; A similarity matrix calculation module, used to construct a matrix based on the sum of the absolute values ​​of the time differences between the first type of alarm and the second type of alarm, and calculate a similarity matrix containing time features based on the matrix; A time feature generation module, used for performing a tiling process on the similarity matrix to generate a time feature similarity matrix, wherein the time feature similarity matrix has the same dimension as the similarity matrix; A multi-dimensional construction module, used for summing the distance similarity matrix and the time feature similarity matrix to construct a multi-dimensional similarity matrix; The three-dimensional update mode module is used to construct a similarity module by calculating each unit value of the multi-dimensional similarity matrix, and the similarity module and the basic module of the nearest neighbor propagation algorithm form a three-dimensional update mode to output the abnormal alarm clustering result.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the method according to any one of claims 1 to 7 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images