Monitoring operation and maintenance system, method and equipment based on artificial intelligence model and medium

Abstract

The invention relates to a monitoring operation and maintenance system, method and device based on an artificial intelligence model and a medium, and the system comprises a data extraction module which is used for extracting alarm information from a database in real time; the alarm prediction module is used for performing alarm suppression prediction processing based on the alarm information through the target alarm suppression prediction model to obtain a suppression prediction result; the analysis report generation module is used for performing alarm suppression processing based on the suppression prediction result to obtain a suppression result, and generating an alarm suppression analysis report according to the suppression result; and the knowledge graph calling module is used for extracting the alarm processing information in the alarm suppression analysis report and calling the operation and maintenance system knowledge graph according to the alarm processing information to obtain a target processing script. According to the invention, closed-loop processing of alarm suppression is realized, and the timeliness of alarm suppression is improved.

Description

Technical Field

[0001] The present application relates to the field of monitoring and operation and maintenance technology, and in particular to a monitoring and operation and maintenance system, method, equipment and medium based on an artificial intelligence model. Background Art

[0002] In the monitoring and operation and maintenance system, a technical problem is: (1) real-time and effective identification and interception of nested alarm storms; (2) automatic triggering of the operation and maintenance process to deal with the corresponding root cause problems in a timely and effective manner. In the traditional operation and maintenance monitoring system, the monitoring system is responsible for real-time modeling of a large number of system resource indicators, including issuing alarms for any abnormal situation. The operation and maintenance system is responsible for manual or automated operation and maintenance of various dimensional resources being monitored. Therefore, there is a separation between the monitoring and operation and maintenance systems for the same batch of monitored resources, requiring manual inspection by operation and maintenance personnel and manual operation to trigger corresponding alarm viewing, operation and maintenance script triggering and other functions. At the same time, the monitored resource indicators have the problem of generating alarm storms due to nesting with each other, requiring intelligent root cause identification and redundant derivative alarm interception. In addition, the root cause alarms that have been screened out need to be processed in real time (i.e. triggering the operation and maintenance system script to solve the problem). Otherwise, if the problem is not handled in time, it may cause abnormal monitoring operation and may also affect the business.

[0003] For problems such as the above, traditional methods may mostly only deal with a single problem or a local phenomenon of a problem. For example, for alarm storms, existing methods such as manual specification, alarm deduplication, alarm classification, and alarm compression belong to statically specified fixed rules. Although they can reduce repeated redundant alarms to a certain extent, they cannot identify and handle the situation of suppressing associated nesting. Assuming that even if the root cause of the blowout alarm storm can be successfully screened, the corresponding resource script of the operation and maintenance system may not be automatically triggered in time due to the separation of system operation. Therefore, the main problem of the existing technology is that it cannot form an intelligent closed loop of "interception + root cause identification + automatic processing" for the "alarm storm", which makes it difficult to handle alarm suppression in a timely manner. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose a monitoring and operation and maintenance system, method, equipment and medium based on an artificial intelligence model to achieve closed-loop processing of alarm suppression and improve the timeliness of alarm suppression.

[0005] In order to solve the above technical problems, the embodiment of the present application provides a monitoring and operation system based on an artificial intelligence model, including:

[0006] Data extraction module, used to extract alarm information from the database in real time;

[0007] An alarm prediction module is used to perform alarm suppression prediction processing based on the alarm information through a target alarm suppression prediction model to obtain a suppression prediction result;

[0008] An analysis report generating module, used for performing alarm suppression processing based on the suppression prediction result, obtaining a suppression result, and generating an alarm suppression analysis report according to the suppression result;

[0009] The knowledge graph retrieval module is used to extract the alarm processing information in the alarm suppression analysis report, and call the operation and maintenance system knowledge graph according to the alarm processing information to obtain the target processing script.

[0010] In order to solve the above technical problems, the embodiment of the present application provides a monitoring and operation method based on an artificial intelligence model, including:

[0011] Extract alarm information from the database in real time;

[0012] Performing alarm suppression prediction processing based on the alarm information through a target alarm suppression prediction model to obtain a suppression prediction result;

[0013] Performing alarm suppression processing based on the suppression prediction result to obtain a suppression result, and generating an alarm suppression analysis report according to the suppression result;

[0014] The alarm processing information in the alarm suppression analysis report is extracted, and the operation and maintenance system knowledge graph is called according to the alarm processing information to obtain a target processing script.

[0015] The embodiment of the present invention provides a monitoring operation and maintenance system, method, device and medium based on an artificial intelligence model. Among them, the system includes: a data extraction module, which is used to extract alarm information from a database in real time; an alarm prediction module, which is used to perform alarm suppression prediction processing based on the alarm information through a target alarm suppression prediction model to obtain a suppression prediction result; an analysis report generation module, which is used to perform alarm suppression processing based on the suppression prediction result to obtain a suppression result, and generate an alarm suppression analysis report according to the suppression result; a knowledge graph call module, which is used to extract the alarm processing information in the alarm suppression analysis report, and call the operation and maintenance system knowledge graph according to the alarm processing information to obtain a target processing script. The embodiment of the present invention can extract alarm information in real time through the data extraction module, and then realize timely prediction processing of alarm information through the alarm prediction module, and then generate an alarm suppression analysis report for the suppression prediction result in real time through the analysis report generation module, and finally generate a target processing alarm for the alarm suppression analysis report through the knowledge graph call module, so as to process the alarm, and then realize the closed-loop processing of alarm suppression, which is conducive to improving the timeliness of alarm suppression. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 It is a schematic diagram of a monitoring and operation and maintenance system based on an artificial intelligence model provided in an embodiment of the present application;

[0018] Figure 2 A schematic diagram of the structure of the alarm prediction module provided in the embodiment of the present application;

[0019] Figure 3 A schematic diagram of the structure of the alarm prediction result generation unit provided in an embodiment of the present application;

[0020] Figure 4 It is a flowchart of the implementation process of the monitoring and operation and maintenance method based on the artificial intelligence model provided in the embodiment of the present application;

[0021] Figure 5 It is a flowchart for implementing the first sub-process in the monitoring and operation method based on the artificial intelligence model provided in the embodiment of the present application;

[0022] Figure 6 It is a flowchart for implementing the second sub-process in the monitoring and operation method based on the artificial intelligence model provided in the embodiment of the present application;

[0023] Figure 7 It is a flowchart for implementing the third sub-process in the monitoring and operation method based on the artificial intelligence model provided in the embodiment of the present application;

[0024] Figure 8 It is a schematic diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0026] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0028] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0029] It should be noted that the monitoring and operation and maintenance method based on the artificial intelligence model provided in the embodiment of the present application is generally executed by a server, and accordingly, the monitoring and operation and maintenance system based on the artificial intelligence model is generally configured in the server.

[0030] The monitoring and operation system based on the artificial intelligence model provided in the embodiment of the present application can be integrated into the existing operation and maintenance platform to handle various alarm monitoring and operation and maintenance function requirements and improve the intelligence of the monitoring and operation closed loop. In this operation and maintenance platform, it is possible to access the real-time data streams, knowledge graphs and various dimensional static information of each functional board for integrated monitoring; it is possible to access, schedule and use different algorithms or machine learning models that have been built; at the same time, it is possible to realize client interaction, and users can access various types of data of monitoring and operation functions, build evaluation algorithms or models, and trigger management AI functions through the platform interface.

[0031] In a specific embodiment, an artificial intelligence operation and maintenance monitoring tool platform is provided, which includes a client, a background application end and a machine learning algorithm model library. In the client, users can use the relevant functions of the platform by themselves, such as: training, using models, using algorithms, implementing interception and viewing reports. The first alarm suppression prediction model, the second alarm suppression prediction model and the third model in the machine learning algorithm model library can extract data from the platform database for algorithm model training and mark the prediction results of the algorithm model. The background application end includes a router layer, an API layer, a model layer and a Service layer. The Service layer is used for receiving and processing real-time data streams. The reception and processing of real-time data streams includes: real-time reception of different data streams of each monitoring and operation and maintenance function module; real-time processing of the received data streams, integrating them into Redis, Mysql databases; real-time deletion of historical data that is not needed by Redis, Mysql; real-time mobilization of corresponding data when the model algorithm is used. The Service layer is used to schedule various functions of the model library, for example, automatic or user-side triggering of various modeling functions, automatic or user-side triggering of various models, algorithm usage judgment interception, and transmission of various real-time information to the corresponding algorithm model when using algorithms or models. It should be noted that the first alarm suppression prediction model and the second alarm suppression prediction model can be scheduled and used at the same time, and the third model needs to be continuously modeled and the database updated, and is not used in actual operations. The service layer also interacts with the client interface, triggers the function on the user front end, and implements scheduling on the back end. The service layer also intercepts the alarm information that needs to be intercepted in real time based on the judgment of the algorithm and model for the implemented K8s log data; at the same time, when the model algorithm model is used, it triggers the construction of the alarm suppression analysis report.

[0032] like Figure 1 As shown, the monitoring and operation and maintenance system based on the artificial intelligence model of this embodiment includes: a data extraction module 101, an alarm prediction module 102, an analysis report generation module 103 and a knowledge graph retrieval module 104, wherein: the data extraction module 101 is used to extract alarm information from the database in real time. The alarm prediction module 102 is used to perform alarm suppression prediction processing based on the alarm information through the target alarm suppression prediction model to obtain a suppression prediction result. The analysis report generation module 103 is used to perform alarm suppression processing based on the suppression prediction result to obtain a suppression result, and generate an alarm suppression analysis report based on the suppression result. The knowledge graph retrieval module 104 is used to extract the alarm processing information in the alarm suppression analysis report, and call the operation and maintenance system knowledge graph according to the alarm processing information to obtain a target processing script.

[0033] Specifically, the monitoring and operation system based on the artificial intelligence model of the present application is a functional platform that combines the artificial intelligence model algorithm library, the front-end client, the back-end application end, and the data warehouse. Among them, the tool platform application end (Go language) is the functional center, which realizes efficient scheduling, data processing, real-time feedback, etc. for other algorithm business sections. The data extraction module 101 in this system can extract alarm information in real time for the real-time log data stream, and organize and pre-process the alarm information, and then store the pre-processed alarm information in the Redis database. Then, the corresponding alarm suppression prediction model is called in the alarm prediction module 102 to perform alarm suppression prediction processing on the alarm information, and it can be judged on the corresponding database sample that the alarm needs to be intercepted and marked. Among them, the alarm suppression prediction model needs to be trained first, and the real-time prediction processing is performed by the trained alarm suppression prediction model. After the suppression result is generated, the alarm suppression processing is performed for the suppression result through the analysis report generation module 103, that is, the alarm information that needs to be intercepted for the Redis database is marked, and it is intercepted in real time, while releasing other information of the real-time log data stream. After the alarm suppression processing, the alarm processing information in the alarm suppression analysis report is extracted through the knowledge graph retrieval module 104, and the operation and maintenance system knowledge graph is called from the operation and maintenance database based on the alarm processing information according to the preset report priority. In the operation and maintenance system knowledge graph, each concept node has an associated operation and maintenance problem processing script, so the corresponding script can be called by querying the concepts in the operation and maintenance system knowledge graph, thereby obtaining the target processing script, and processing related alarm monitoring problems through the target processing script.

[0034] In a specific embodiment, the data extraction module 101 includes: an alarm information extraction unit, used to extract initial alarm information from the real-time log data stream of the database; an alarm information storage unit, used to pre-process the initial alarm information data, obtain the alarm information, and store the alarm information in the Redis database.

[0035] Specifically, in the data extraction module 101, the initial alarm information is extracted from the real-time log data stream of the database, specifically from the json information of the data block. Then the initial alarm information is preprocessed, such as preprocessing including data sorting and other operations, to generate alarm information, and then the alarm information is stored in the Redis database. Similarly, the alarm information can also be stored in the Mysql database.

[0036] In a specific embodiment, the target alarm suppression prediction model includes a first alarm suppression prediction model and a second alarm suppression prediction model; Figure 2 As shown, Figure 2The structural diagram of the alarm prediction module provided in the embodiment of the present application, the alarm prediction module 102 includes:

[0037] A first alarm suppression prediction unit 1021 is used to perform alarm suppression prediction processing based on the multi-variable input of the alarm information at the same time through the first alarm suppression prediction model to generate a first prediction result of the multi-variable output;

[0038] A second alarm suppression prediction unit 1022 is used to perform alarm suppression prediction processing based on the parent-child clusters in the alarm information within the same time through the second alarm suppression prediction model to generate a second prediction result;

[0039] The alarm prediction result generating unit 1023 is used to generate the suppression prediction result according to the first prediction result and the second prediction result.

[0040] Specifically, in the alarm prediction module 102, the target alarm suppression prediction model is used to perform alarm suppression prediction processing based on the alarm information in the same unit time to obtain a suppression prediction result. The target alarm suppression prediction model includes a first alarm suppression prediction model and a second alarm suppression prediction model. Among them, the first alarm suppression prediction model is a model generated by defining the associated nested relationship of the top of the monitored indicators through a tree structure and modeling the tree structure.

[0041] Among them, the first alarm suppression prediction model is to suppress and intercept the alarms of all downstream nodes if the upstream node alarm exists in the same unit time. In this model, the tree structure node relationship confirms the relationship between the feature variable and the prediction result. According to the complexity of different dictionaries, different algorithms are selected (which can be random forest or deep neural network algorithm); the model has multi-variable input and multi-variable output, for example, X: whether the alarm of each benchmark situation appears or not [0-> not appear; 1-> appear], Y: whether each benchmark situation should be suppressed [1-> suppress; 0-> not suppress]. The model built by each dictionary is only responsible for identifying and suppressing the situations detailed in the dictionary. If there is no corresponding situation, it will not judge the interception. The second alarm suppression prediction model is mainly to monitor clusters of different sizes / parent-child relationships in real time to ensure that each cluster will not have an alarm blowout or even a storm. That is, regardless of the conceptual nesting relationship between indicators, the second alarm suppression prediction model fundamentally implements cluster real-time monitoring and prevents the occurrence of alarm storms. The second alarm suppression prediction model is that if the alarm percentage of a sub-cluster exceeds a threshold and there are (single or all) alarms of the parent cluster within the same unit time, all alarms of the sub-cluster are suppressed and intercepted.

[0042] Therefore, in an embodiment of the present application, the first alarm suppression prediction unit 1021 is used to perform alarm suppression prediction processing based on the multi-variable input of the alarm information within the same time through the first alarm suppression prediction model, and generate a first prediction result of the multi-variable output; the second alarm suppression prediction unit 1022 is used to perform alarm suppression prediction processing based on the parent-child clusters in the alarm information within the same time through the second alarm suppression prediction model, and generate a second prediction result; the alarm prediction result generation unit 1023 is used to generate the suppression prediction result according to the first prediction result and the second prediction result.

[0043] In a specific embodiment, Figure 3 As shown, Figure 3 A schematic diagram of the structure of the alarm prediction result generation unit provided in an embodiment of the present application, wherein the alarm prediction result generation unit 1023 includes:

[0044] An identification subunit 10231, configured to identify suppressed alarm information in the database according to the first prediction result and the second prediction result;

[0045] The marking subunit 10232 is used to mark according to the suppressed alarm information to obtain the alarm prediction result.

[0046] Specifically, the alarm prediction result generating unit 1023 includes an identification subunit 10231 and a marking subunit 10232. In the identification subunit 10231, the suppressed alarm information is identified in the database according to the first prediction result and the second prediction result. Specifically, the row and column of the suppressed alarm information are identified in the database according to the first prediction result and the second prediction result, and then the suppressed alarm information is marked according to the row and column in the marking subunit 10232 to obtain the alarm prediction result.

[0047] In a specific embodiment, the analysis report generating module 103 includes:

[0048] A suppression result generating unit, configured to perform alarm suppression processing according to the suppression prediction result to obtain the suppression result, wherein the suppression result includes the alarm interception result, the intercepted object situation and the interception time;

[0049] The prompt information acquisition unit is used to acquire the alarm processing information according to the suppression result, and generate the alarm suppression analysis report according to the suppression result and the alarm processing information.

[0050] Specifically, the suppression prediction result has been generated in the above module. In the suppression result generation unit, it is necessary to perform alarm suppression processing according to the suppression prediction result to obtain the suppression result, that is, in the suppression result generation unit, it is necessary to intercept the alarm information marked by Redis to be intercepted in real time, and release other information of the real-time log data stream at the same time. After the alarm interception processing is completed, the suppression result is obtained, wherein the suppression result includes the alarm interception result, the intercepted object situation and the interception time. Then in the prompt information acquisition unit, the alarm processing information is obtained according to the suppression result, and the alarm suppression analysis report is generated according to the suppression result and the alarm processing information. Among them, the alarm processing information is the prompt information of the alarm solution method, which is the solution prompt information pre-constructed according to the alarm information interception situation. The alarm suppression analysis report is a report generated after the artificial intelligence algorithm model is processed. In a specific embodiment, according to the real-time alarm interception and model usage, the corresponding interception information is integrated, and an AIGC report request is sent to the third-party interface to generate an alarm suppression analysis report. The alarm suppression analysis report may be sent to the user terminal after receiving the request information triggered by the user terminal.

[0051] In a specific embodiment, the knowledge graph retrieval module 104 includes:

[0052] An analysis report parsing unit, configured to parse the alarm suppression analysis report and extract the alarm processing information in the parsed alarm suppression analysis report;

[0053] A processing script generating unit is used to call the operation and maintenance system knowledge graph from the operation and maintenance system database based on the alarm processing information according to a preset report priority, so as to obtain the target processing script from the operation and maintenance system knowledge graph.

[0054] Specifically, the alarm suppression analysis report is parsed in the analysis report parsing unit, and the alarm processing information in the parsed alarm suppression analysis report is extracted. The alarm processing information is prompt information of the alarm solution method, and then the operation and maintenance system knowledge graph is called from the operation and maintenance system database based on the alarm processing information according to the preset report priority in the processing script generation unit to obtain the target processing script from the operation and maintenance system knowledge graph. Among them, in the operation and maintenance system knowledge graph, each concept node has an associated operation and maintenance problem processing script, so the corresponding script can be called by querying the concept in the knowledge graph to handle related monitoring problems.

[0055] In a specific embodiment, in the monitoring and operation and maintenance system based on the artificial intelligence model, by constructing a third model, the third model is used to process the analysis report generation module 103 and the knowledge graph retrieval module 104. After the first alarm suppression prediction model and the second alarm suppression prediction model intercept, filter, and identify the root cause of the indicator alarm. The root cause alarm identified by the third model needs to be processed. The third model generates a corresponding target processing script for the prompt information for solving the problem in the alarm suppression analysis report of the root problem alarm, as well as the knowledge graph of the operation and maintenance system. Among them, the alarm suppression analysis report can provide suggestions for solving the problem. For example, for CPU abnormalities, it is recommended to restart immediately. View the knowledge concept graph according to the suggestions in the alarm suppression analysis report, and retrieve and run the processing script of the relevant concept (such as: "restart") through the knowledge graph. The third model continuously optimizes the relationship structure of [concept-script] in the knowledge graph, so that the operation and maintenance system can more accurately locate and schedule the use of the correct problem handling script when it is implemented.

[0056] In a specific embodiment, the system in the embodiment of the present application needs to clear historical alarm information in real time.

[0057] In the embodiment of the present application, the data extraction module is used to extract alarm information from the database in real time; the alarm prediction module is used to perform alarm suppression prediction processing based on the alarm information through the target alarm suppression prediction model to obtain the suppression prediction result; the analysis report generation module is used to perform alarm suppression processing based on the suppression prediction result to obtain the suppression result, and generate the alarm suppression analysis report according to the suppression result; the knowledge graph retrieval module is used to extract the alarm processing information in the alarm suppression analysis report, and call the operation and maintenance system knowledge graph according to the alarm processing information to obtain the target processing script. The embodiment of the present invention can extract alarm information in real time through the data extraction module, and then realize the timely prediction processing of the alarm information through the alarm prediction module, and then generate the alarm suppression analysis report for the suppression prediction result in real time through the analysis report generation module, and finally generate the target processing alarm for the alarm suppression analysis report through the knowledge graph retrieval module, so as to process the alarm, and then realize the closed-loop processing of alarm suppression, which is conducive to improving the timeliness of alarm suppression.

[0058] See also Figure 4 , Figure 4 A specific implementation of a monitoring and operation method based on an artificial intelligence model is shown.

[0059] S201: Extract alarm information from the database in real time.

[0060] Specifically, the initial alarm information is extracted from the real-time log data stream of the database, specifically from the json information of the data block. The initial alarm information is then preprocessed, such as preprocessing including data sorting and other operations, to generate alarm information, and then the alarm information is stored in the Redis database. Similarly, the alarm information can also be stored in the Mysql database.

[0061] S202: Performing alarm suppression prediction processing based on the alarm information through a target alarm suppression prediction model to obtain a suppression prediction result.

[0062] See also Figure 5 , Figure 5 A specific implementation of step S202 is shown, which is described in detail as follows:

[0063] S2021: Perform alarm suppression prediction processing based on the multi-variable input of the alarm information at the same time through the first alarm suppression prediction model to generate a first prediction result of multi-variable output.

[0064] S2022: Perform alarm suppression prediction processing based on the parent-child clusters in the alarm information within the same time period through the second alarm suppression prediction model to generate a second prediction result.

[0065] S2023: Generate the suppression prediction result according to the first prediction result and the second prediction result.

[0066] Specifically, the target alarm suppression prediction model performs alarm suppression prediction processing based on the alarm information in the same unit time to obtain a suppression prediction result. The target alarm suppression prediction model includes a first alarm suppression prediction model and a second alarm suppression prediction model. Among them, the first alarm suppression prediction model is a model generated by defining the top-level associated nested relationship of the monitored indicators through a tree structure and modeling the tree structure.

[0067] Among them, the first alarm suppression prediction model is to suppress and intercept the alarms of all downstream nodes if the upstream node alarm exists in the same unit time. In this model, the tree structure node relationship confirms the relationship between the feature variable and the prediction result. According to the complexity of different dictionaries, different algorithms are selected (which can be random forest or deep neural network algorithm); the model has multi-variable input and multi-variable output, for example, X: whether the alarm of each benchmark situation appears or not [0-> not appear; 1-> appear], Y: whether each benchmark situation should be suppressed [1-> suppress; 0-> not suppress]. The model built by each dictionary is only responsible for identifying and suppressing the situations detailed in the dictionary. If there is no corresponding situation, it will not judge the interception. The second alarm suppression prediction model is mainly to monitor clusters of different sizes / parent-child relationships in real time to ensure that each cluster will not have an alarm blowout or even a storm. That is, regardless of the conceptual nesting relationship between indicators, the second alarm suppression prediction model fundamentally implements cluster real-time monitoring and prevents the occurrence of alarm storms. The second alarm suppression prediction model is that if the alarm percentage of a sub-cluster exceeds a threshold and there are (single or all) alarms of the parent cluster within the same unit time, all alarms of the sub-cluster are suppressed and intercepted.

[0068] Therefore, in an embodiment of the present application, the first alarm suppression prediction model is used to perform alarm suppression prediction processing based on the multi-variable input of the alarm information within the same time, and a first prediction result of multi-variable output is generated; the second alarm suppression prediction model is used to perform alarm suppression prediction processing based on the parent-child clusters in the alarm information within the same time, and a second prediction result is generated; and the suppression prediction result is generated based on the first prediction result and the second prediction result.

[0069] See also Figure 6 , Figure 6 A specific implementation of step S2023 is shown, which is described in detail as follows:

[0070] S20231: Identify suppressed alarm information in the database according to the first prediction result and the second prediction result.

[0071] S20232: Marking is performed according to the suppressed alarm information to obtain the alarm prediction result.

[0072] Specifically, the suppressed alarm information is identified in the database according to the first prediction result and the second prediction result. Specifically, the rows and columns of the suppressed alarm information are identified in the database according to the first prediction result and the second prediction result, and then the suppressed alarm information is marked according to the rows and columns to obtain the alarm prediction result.

[0073] S203: Perform alarm suppression processing based on the suppression prediction result to obtain a suppression result, and generate an alarm suppression analysis report according to the suppression result.

[0074] See also Figure 7 , Figure 7 A specific implementation of step S203 is shown, which is described in detail as follows:

[0075] S2031: Perform alarm suppression processing according to the suppression prediction result to obtain the suppression result, wherein the suppression result includes the alarm interception result, the intercepted object situation and the interception time.

[0076] S2032: Acquire the alarm processing information according to the suppression result, and generate the alarm suppression analysis report according to the suppression result and the alarm processing information.

[0077] Specifically, the suppression prediction result has been generated in the above steps, and the alarm suppression processing needs to be performed according to the suppression prediction result to obtain the suppression result, that is, the alarm information that needs to be intercepted by Redis is intercepted in real time, and other information of the real-time log data stream is released at the same time. After the alarm interception processing is completed, the suppression result is obtained, wherein the suppression result includes the alarm interception result, the intercepted object situation and the interception time. Then the alarm processing information is obtained according to the suppression result, and the alarm suppression analysis report is generated according to the suppression result and the alarm processing information. Among them, the alarm processing information is the prompt information of the alarm solution method, and the prompt information is the solution prompt information pre-constructed according to the alarm information interception situation. The alarm suppression analysis report is a report generated after the artificial intelligence algorithm model is processed. In a specific embodiment, according to the real-time alarm interception and model usage, the corresponding interception information is integrated, and the AIGC report request is sent to the third-party interface to generate an alarm suppression analysis report. The alarm suppression analysis report can send the alarm suppression analysis report to the user end after receiving the request information triggered by the user end.

[0078] S204: extracting alarm processing information from the alarm suppression analysis report, and calling the operation and maintenance system knowledge graph according to the alarm processing information to obtain a target processing script.

[0079] Specifically, the alarm suppression analysis report is parsed, and the alarm processing information in the parsed alarm suppression analysis report is extracted. The alarm processing information is prompt information of the alarm solution method, and then the operation and maintenance system knowledge graph is called from the operation and maintenance system database based on the alarm processing information in the processing script generation unit according to the preset report priority to obtain the target processing script from the operation and maintenance system knowledge graph. Among them, in the operation and maintenance system knowledge graph, each concept node has an associated operation and maintenance problem processing script, so the corresponding script can be called by querying the concept in the knowledge graph to handle related monitoring problems.

[0080] In a specific embodiment, the system in the embodiment of the present application needs to clear historical alarm information in real time.

[0081] In an embodiment of the present application, alarm information is extracted from a database in real time; alarm suppression prediction processing is performed based on the alarm information through a target alarm suppression prediction model to obtain a suppression prediction result; alarm suppression processing is performed based on the suppression prediction result to obtain a suppression result, and an alarm suppression analysis report is generated based on the suppression result; the alarm processing information in the alarm suppression analysis report is extracted, and the operation and maintenance system knowledge graph is called according to the alarm processing information to obtain a target processing script. The embodiment of the present invention can extract alarm information in real time, and perform timely prediction and processing on the alarm information, and then generate an alarm suppression analysis report for the suppression prediction result in real time, and finally generate a target processing alarm for the alarm suppression analysis report, thereby processing the alarm, and then realizing closed-loop processing of alarm suppression, which is conducive to improving the timeliness of alarm suppression.

[0082] To solve the above technical problems, the present application also provides a computer device. Figure 8 , Figure 8 This is a basic structural block diagram of the computer device in this embodiment.

[0083] The computer device 6 includes a memory 61, a processor 62, and a network interface 63 which are interconnected through a system bus. It should be noted that: Figure 8 Only a computer device 6 having three components, memory 61, processor 62, and network interface 63, is shown, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), digital signal processors (DSP), embedded devices, etc.

[0084] Computer devices can be computing devices such as desktop computers, notebooks, PDAs, and cloud servers. Computer devices can interact with users through keyboards, mice, remote controls, touch pads, or voice control devices.

[0085] The memory 61 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 61 can be an internal storage unit of the computer device 6, such as a hard disk or memory of the computer device 6. In other embodiments, the memory 61 can also be an external storage device of the computer device 6, such as a plug-in hard disk equipped on the computer device 6, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 61 can also include both the internal storage unit of the computer device 6 and its external storage device. In this embodiment, the memory 61 is generally used to store the operating system and various application software installed on the computer device 6, such as the program code of the monitoring and operation method based on the artificial intelligence model, etc. In addition, the memory 61 can also be used to temporarily store various types of data that have been output or are to be output.

[0086] The processor 62 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 62 is generally used to control the overall operation of the computer device 6. In this embodiment, the processor 62 is used to run the program code stored in the memory 61 or process data, such as running the program code of the monitoring and operation method based on the artificial intelligence model to implement various embodiments of the monitoring and operation method based on the artificial intelligence model.

[0087] The network interface 63 may include a wireless network interface or a wired network interface, and the network interface 63 is generally used to establish a communication connection between the computer device 6 and other electronic devices.

[0088] The present application also provides another implementation, namely, providing a computer-readable storage medium, which stores a computer program, and the computer program can be executed by at least one processor to enable the at least one processor to perform the steps of a monitoring and operation method based on an artificial intelligence model as described above.

[0089] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0090] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the present application specification and the accompanying drawings, directly or indirectly used in other related technical fields, is similarly within the scope of protection of the present application.

Claims

1. A monitoring and operation system based on an artificial intelligence model, characterized in that: include: Data extraction module, used to extract alarm information from the database in real time; An alarm prediction module is used to perform alarm suppression prediction processing based on the alarm information through a target alarm suppression prediction model to obtain a suppression prediction result; An analysis report generating module, used for performing alarm suppression processing based on the suppression prediction result, obtaining a suppression result, and generating an alarm suppression analysis report according to the suppression result; The knowledge graph retrieval module is used to extract the alarm processing information in the alarm suppression analysis report, and call the operation and maintenance system knowledge graph according to the alarm processing information to obtain the target processing script.

2. The monitoring and operation system based on the artificial intelligence model according to claim 1 is characterized in that: The target alarm suppression prediction model includes a first alarm suppression prediction model and a second alarm suppression prediction model; the alarm prediction module includes: A first alarm suppression prediction unit, configured to perform alarm suppression prediction processing based on the multi-variable input of the alarm information at the same time through the first alarm suppression prediction model, and generate a first prediction result of the multi-variable output; A second alarm suppression prediction unit, configured to perform alarm suppression prediction processing based on the parent-child clusters in the alarm information within the same time period through the second alarm suppression prediction model to generate a second prediction result; An alarm prediction result generating unit is used to generate the suppression prediction result according to the first prediction result and the second prediction result.

3. The monitoring and operation system based on the artificial intelligence model according to claim 2 is characterized in that: The alarm prediction result generating unit comprises: an identification subunit, configured to identify suppressed alarm information in the database according to the first prediction result and the second prediction result; The marking subunit is used to mark according to the suppressed alarm information to obtain the alarm prediction result.

4. The monitoring and operation system based on the artificial intelligence model according to claim 1 is characterized in that: The analysis report generating module comprises: A suppression result generating unit, configured to perform alarm suppression processing according to the suppression prediction result to obtain the suppression result, wherein the suppression result includes the alarm interception result, the intercepted object situation and the interception time; The prompt information acquisition unit is used to acquire the alarm processing information according to the suppression result, and generate the alarm suppression analysis report according to the suppression result and the alarm processing information.

5. The monitoring and operation system based on the artificial intelligence model according to claim 4 is characterized in that: The knowledge graph retrieval module includes: An analysis report parsing unit, configured to parse the alarm suppression analysis report and extract the alarm processing information in the parsed alarm suppression analysis report; A processing script generating unit is used to call the operation and maintenance system knowledge graph from the operation and maintenance system database based on the alarm processing information according to a preset report priority, so as to obtain the target processing script from the operation and maintenance system knowledge graph.

6. The monitoring and operation system based on the artificial intelligence model according to any one of claims 1 to 5, characterized in that: The data extraction module comprises: An alarm information extraction unit, used to extract initial alarm information from the real-time log data stream of the database; The alarm information storage unit is used to pre-process the initial alarm information data to obtain the alarm information and store the alarm information in a Redis database.

7. A monitoring and operation method based on an artificial intelligence model, characterized in that: include: Extract alarm information from the database in real time; Performing alarm suppression prediction processing based on the alarm information through a target alarm suppression prediction model to obtain a suppression prediction result; Performing alarm suppression processing based on the suppression prediction result to obtain a suppression result, and generating an alarm suppression analysis report according to the suppression result; The alarm processing information in the alarm suppression analysis report is extracted, and the operation and maintenance system knowledge graph is called according to the alarm processing information to obtain a target processing script.

8. The monitoring and operation method based on the artificial intelligence model according to claim 7 is characterized in that: The target alarm suppression prediction model includes a first alarm suppression prediction model and a second alarm suppression prediction model; the target alarm suppression prediction model performs alarm suppression prediction processing based on the alarm information to obtain a suppression prediction result, including: Performing alarm suppression prediction processing based on the multivariate input of the alarm information at the same time through the first alarm suppression prediction model to generate a first prediction result of the multivariate output; Performing alarm suppression prediction processing based on the parent-child clusters in the alarm information within the same time period through the second alarm suppression prediction model to generate a second prediction result; The suppression prediction result is generated according to the first prediction result and the second prediction result.

9. A computer device, characterized in that: It includes a memory and a processor, the memory stores a computer program, and the processor implements the monitoring and operation method based on the artificial intelligence model as described in any one of claims 7 to 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the monitoring and operation method based on the artificial intelligence model as described in any one of claims 7 to 8 is implemented.

Images