Alarm forwarding method, computer program product, device and computer medium

Abstract

The invention discloses an alarm forwarding method, a computer program product, equipment and a computer medium, and relates to the technical field of data processing. Determining a preset number of pre-trained alarm forwarding decision trees; identifying the target alarm data based on each alarm forwarding decision tree to obtain an initial alarm type of the to-be-forwarded alarm; processing all the initial alarm types to obtain a target alarm type; forwarding the target alarm data consistent with the target alarm type; wherein the value of the preset number is greater than or equal to 2. According to the method and the device, the preset number of initial alarm types can be automatically obtained by applying the preset number of alarm forwarding decision trees, the alarm forwarding does not need to be manually set, the alarm forwarding strategy does not need to be inquired, and the alarm forwarding efficiency is improved; and equivalently, a plurality of initial alarm types are screened to obtain the target alarm type, so that the screening standard of alarm forwarding is refined, and the accuracy of alarm forwarding is improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and more specifically, to an alarm forwarding method, a computer program product, a device and a computer medium. Background Art

[0002] During the operation of servers and other devices, alarms can be used to warn of errors on the devices. During this process, the alarm field selected by the user can be stored in the form of a string, and this alarm field can be associated with the alarm forwarding strategy. In this way, after the device generates an alarm, the corresponding alarm can be forwarded through the alarm forwarding strategy.

[0003] However, this method requires manual selection of alarm fields to set alarm forwarding, and the alarm forwarding policy needs to be queried every time, which is cumbersome, inefficient, and prone to errors.

[0004] In summary, how to efficiently and accurately forward alarms is a problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0005] The purpose of the present invention is to provide an alarm forwarding method, which can solve the technical problem of how to efficiently and accurately forward alarms to a certain extent. The present invention also provides a computer program product, an electronic device and a computer-readable storage medium.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] In a first aspect, an alarm forwarding method is provided, comprising:

[0008] Obtain target warning data;

[0009] Determine a preset number of pre-trained alarm forwarding decision trees;

[0010] Identifying the target alarm data based on each of the alarm forwarding decision trees to obtain an initial alarm type of the alarm to be forwarded;

[0011] Processing all the initial alarm types to obtain a target alarm type;

[0012] Forwarding the target alarm data consistent with the target alarm type;

[0013] Wherein, the value of the preset number is greater than or equal to 2.

[0014] On the other hand, before determining the pre-trained preset number of alarm forwarding decision trees, it also includes:

[0015] Obtain a training alarm data set;

[0016] Randomly selecting a first number of training alarm data from the training alarm data set to obtain a set of training alarm data subsets;

[0017] Count the number of groups of training alarm data subsets;

[0018] In response to the number of groups of the training alarm data subset being less than the preset number, returning to execute the step of randomly selecting a target number of training alarm data from the training alarm data set;

[0019] In response to the number of groups of the training alarm data subsets being equal to the preset number, a corresponding alarm forwarding decision tree is obtained by training based on each group of the training alarm data subsets.

[0020] On the other hand, obtain the training alarm data set, including:

[0021] Obtain the original alarm data set;

[0022] In the original alarm data set, relevant alarm data in the same time period are used as training alarm data sets.

[0023] On the other hand, in the original alarm data set, alarm data in the same time period and related are used as training alarm data sets, including:

[0024] Determine the target time period;

[0025] For each alarm data in the original alarm data set, if the alarm data belongs to the target time period, adding the alarm data to the original alarm data subset corresponding to the target time period;

[0026] Determining whether the alarm data in the original alarm data subset meets the correlation condition;

[0027] In response to the alarm data in the original alarm data subset satisfying the correlation condition, the original alarm data subset is used as a training alarm data set.

[0028] On the other hand, before determining whether the alarm data in the original alarm data subset meets the correlation condition, the method further includes:

[0029] Determining whether the alarm data in the original alarm data subset is within a set time range;

[0030] In response to the alarm data in the original alarm data subset being within a set time range, a step of determining whether the alarm data in the original alarm data subset meets a correlation condition is performed.

[0031] On the other hand, for each alarm data in the original alarm data set, if the alarm data belongs to the target time period, the alarm data is added to the original alarm data subset corresponding to the target time period, including:

[0032] Generate a current time window corresponding to the target time period;

[0033] For each alarm data in the original alarm data set, if the alarm data belongs to the current time window, the alarm data is added to the original alarm data subset corresponding to the current time window.

[0034] On the other hand, the corresponding alarm forwarding decision tree is trained based on each group of training alarm data subsets, including:

[0035] For each set of training alarm data subsets, dividing the training alarm data subsets into a first alarm data subset and a second alarm data subset;

[0036] Randomly generate the number of decision trees and the number of split attributes;

[0037] According to the number of decision trees and the number of splitting attributes, the first subset of alarm data is used to generate an original decision tree;

[0038] Using the second subset of alarm data to generate a fitness value of the original decision tree;

[0039] The original decision tree is selected according to the fitness value to obtain an alarm forwarding decision tree.

[0040] On the other hand, randomly generate the number of decision trees and split attribute values, including:

[0041] Determine a first value range of the decision tree quantity value;

[0042] Determine a second value range of the split attribute value;

[0043] Initializing the positions and velocities of the second number of particles, wherein the position of each particle is determined according to the first value range and the second value range;

[0044] Generate the position and speed of the particle in the current round according to the initial position and initial speed of the particle;

[0045] Convert the particle position in the current round into the number of decision trees and the number of split attributes in the current round;

[0046] According to the number of decision trees and the number of splitting attributes, the first subset of alarm data is used to generate an original decision tree, including:

[0047] According to the number of decision trees in the current round and the number of split attributes in the current round, the first alarm data subset is used to generate an original decision tree.

[0048] On the other hand, after applying the second subset of alarm data to generate the fitness value of the original decision tree, the method further includes:

[0049] According to the fitness value, updating the local optimal position of each particle and updating the global optimal position;

[0050] In response to not meeting the set termination condition, returning to the step of generating the position and velocity of the particle in the current round according to the initialization position and initialization velocity of the particle;

[0051] In response to satisfying the set termination condition, the process ends;

[0052] The original decision tree is selected according to the fitness value to obtain an alarm forwarding decision tree, including:

[0053] The decision tree corresponding to the last recorded local optimal position is determined as the alarm forwarding decision tree.

[0054] On the other hand, according to the initial position and initial velocity of the particle, the position and velocity of the particle in the current round are generated, including:

[0055] Generate drift coefficients and attractors;

[0056] Generate the average optimal position of the particle group based on the local optimal position of the particle in the previous round;

[0057] Generate the particle speed in the current round based on the group average optimal position, drift coefficient, attractor and the particle position in the previous round;

[0058] Generate the position of the particle in the current round according to the position of the particle in the previous round and the speed of the particle in the current round;

[0059] Among them, when the current round is the first round, the position of the particle in the previous round is the initialization position, and the speed of the particle in the previous round is the initialization speed.

[0060] On the other hand, drift coefficients and attractors are generated, including:

[0061] generating a first constant and a second constant;

[0062] Generate a first random number and a second random number;

[0063] Generate a drift coefficient according to the first constant, the second constant, the first random number, and the second random number;

[0064] An attractor is generated according to a first constant, a second constant, a first random number, a second random number, a global optimal position of a previous round, and a local optimal position of a particle in the previous round.

[0065] On the other hand, the velocity of the particle in the current round is generated according to the group average optimal position, drift coefficient, attractor and the position of the particle in the previous round, including:

[0066] Generate the Gaussian distribution standard deviation based on the average optimal position of the group and the position of the particle in the previous round;

[0067] Generate a Gaussian distribution function;

[0068] Generate the difference between the attractor and the particle's position in the previous round;

[0069] Generate the particle speed in the current round based on the drift coefficient, difference, Gaussian distribution standard deviation and Gaussian distribution function.

[0070] In a second aspect, a computer program product is provided, comprising a computer program / instruction, which, when executed by a processor, implements the steps of any of the above-described alarm forwarding methods.

[0071] According to a third aspect, an electronic device is provided, including:

[0072] Memory for storing computer programs;

[0073] A processor is used to implement the steps of any of the above-mentioned alarm forwarding methods when executing the computer program.

[0074] In a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the steps of any of the above alarm forwarding methods are implemented.

[0075] The present invention provides an alarm forwarding method, which obtains target alarm data; determines a preset number of pre-trained alarm forwarding decision trees; identifies the target alarm data based on each alarm forwarding decision tree to obtain the initial alarm type of the alarm to be forwarded; processes all initial alarm types to obtain the target alarm type; and forwards the target alarm data consistent with the target alarm type; wherein the value of the preset number is greater than or equal to 2. The beneficial effects of the present invention are as follows: a preset number of alarm forwarding decision trees are pre-trained, and each alarm forwarding decision tree can identify the target alarm data to obtain the initial alarm type of the alarm to be forwarded, that is, a preset number of alarm forwarding decision trees can be applied to automatically obtain a preset number of initial alarm types, without the need to manually set the alarm forwarding, and without the need to query the alarm forwarding strategy, thereby improving the efficiency of alarm forwarding; and after obtaining the preset number of initial alarm types, all initial alarm types need to be processed to obtain the target alarm type, and then the target alarm data consistent with the target alarm type is forwarded, which is equivalent to screening multiple initial alarm types to obtain the target alarm type, and realizing the forwarding of the target alarm data by comprehensively considering the identification results of multiple alarm forwarding decision trees, and compared with applying a single alarm forwarding strategy to forward the alarm, the screening criteria for alarm forwarding are refined, and the accuracy of alarm forwarding is improved. A computer program product, electronic device and computer-readable storage medium provided by the present invention also solve the corresponding technical problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0077] Figure 1 A flowchart of an alarm forwarding method provided by an embodiment of the present invention;

[0078] Figure 2 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention;

[0079] Figure 3 Another structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0080] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0081] See also Figure 1 , Figure 1 A flowchart of an alarm forwarding method provided by an embodiment of the present invention.

[0082] An alarm forwarding method provided by an embodiment of the present invention may include the following steps:

[0083] Step S101: Acquire target alarm data.

[0084] In actual applications, the target alarm data can be obtained first. The type and quantity of the target alarm data can be flexibly determined according to the application scenario. For example, the target alarm data can be the alarm data generated by the server within a period of time. Since the alarm data reflects the fault information of the equipment, the alarm data needs to be forwarded to the user for processing. Therefore, it is necessary to decide whether to forward the target alarm data.

[0085] Step S102: Determine a preset number of pre-trained alarm forwarding decision trees; the value of the preset number is greater than or equal to 2.

[0086] Step S103: identifying the target alarm data based on each alarm forwarding decision tree to obtain the initial alarm type of the alarm to be forwarded.

[0087] In practical applications, the present invention pre-trains a preset number of alarm forwarding decision trees, and the value of the preset number is greater than or equal to 2, that is, the present invention pre-trains multiple alarm forwarding decision trees, each of which can identify the alarm data to obtain the alarm type of the alarm to be forwarded, and the identification methods of the preset number of alarm forwarding decision trees can be different, for example, some alarm forwarding decision trees can identify whether to forward alarms related to the CPU (Central Processing Unit), and some alarm forwarding decision trees can identify whether to forward alarms related to the power supply. Of course, all alarm forwarding decision trees can also identify whether to forward the same type of alarm from different aspects. Correspondingly, the present invention can use each alarm forwarding decision tree to identify the target alarm data and obtain the corresponding initial alarm type. It is not difficult to understand that the initial alarm type represents the type of the required forwarding alarm output by the alarm forwarding decision tree, and each alarm forwarding decision tree can output one alarm type, so the preset number of alarm forwarding decision trees can obtain a preset number of initial alarm types.

[0088] In practical applications, the training of the alarm forwarding decision tree is inseparable from the training data set, so before determining the pre-trained preset number of alarm forwarding decision trees, you can also obtain a training alarm data set; randomly select a first number of training alarm data from the training alarm data set to obtain a group of training alarm data subsets; count the number of groups of the training alarm data subsets; in response to the number of groups of the training alarm data subsets being less than the preset number, return to execute the step of randomly selecting a target number of training alarm data from the training alarm data set; in response to the number of groups of the training alarm data subsets being equal to the preset number, train the corresponding alarm forwarding decision tree based on each group of training alarm data subsets.

[0089] From this implementation process, it can be seen that after obtaining the training alarm data set, the present invention randomly selects a first number of training alarm data from the training alarm data set to obtain a set of training alarm data subsets. Since the training alarm data is selected from the training alarm data set each time, it is equivalent to generating a training alarm data subset by the self-help method. The size of each training alarm data subset generated in this way is the same, but it is equivalent to sampling with replacement. Some samples may appear multiple times in the same subset, while some samples may not be drawn at all. Therefore, the types of training alarm data in the training alarm data subset are diverse and highly random, so that subsequent training A variety of alarm forwarding decision trees with recognition capabilities or recognition methods can be obtained; and when the number of groups of the training alarm data subsets is less than the preset number, it is necessary to return to execute the step of randomly selecting a target number of training alarm data from the training alarm data set to increase the number of training alarm data sets. When the number of groups of the training alarm data subsets is equal to the preset number, the corresponding alarm forwarding decision trees are trained based on each group of training alarm data subsets, which is equivalent to training a class of alarm forwarding decision trees with a group of training alarm data subsets, so that with the help of the preset number of groups of training alarm data subsets, it can be guaranteed that at least a preset number of alarm forwarding decision trees can be obtained.

[0090] In specific application scenarios, considering that there may be correlation between alarm data, and related alarm data can be used together for equipment failure analysis, etc., the original alarm data set can be obtained in the process of obtaining the training alarm data set. The original alarm data set is the original alarm data generated by the device itself; in the original alarm data set, the alarm data that are in the same time period and are related are used as the training alarm data set. In this way, the training alarm data set is composed of alarm data that are in the same time period and are related. The alarm forwarding decision tree subsequently obtained through the training alarm data can identify the alarm data that are in the same time period and are related.

[0091] In a specific application scenario, in the original alarm data set, the target time period can be determined in the process of using the alarm data in the same time period and related to each other as the training alarm data set; for each alarm data in the original alarm data set, if the alarm data belongs to the target time period, the alarm data is added to the original alarm data subset corresponding to the target time period; it is determined whether the alarm data in the original alarm data subset meets the correlation condition; in response to the alarm data in the original alarm data subset meeting the correlation condition, the original alarm data subset is used as the training alarm data set. Before determining whether the alarm data in the original alarm data subset meets the correlation condition, it is also possible to determine whether the alarm data in the original alarm data subset is within a set time range, which can be a time range within the target time period, etc.; in response to the alarm data in the original alarm data subset being within the set time range, the step of determining whether the alarm data in the original alarm data subset meets the correlation condition is performed.

[0092] In specific application scenarios, for each alarm data in the original alarm data set, if the alarm data belongs to the target time period, the alarm data is added to the original alarm data subset corresponding to the target time period. The alarm data can be collected with the help of the time window, that is, the current time window corresponding to the target time period can be generated; for each alarm data in the original alarm data set, if the alarm data belongs to the current time window, the alarm data is added to the original alarm data subset corresponding to the current time window.

[0093] Of course, you can also use a double sliding window to obtain the training alarm data set. For ease of understanding, assume that window_size_time represents the size of the time window, and the time unit can be seconds, minutes, etc.; time_range_condition represents a function used to check whether the data points in the time window meet the given time range conditions; alert_correlation_condition represents a function used to check the correlation between alarms. For example, when a CPU alarm occurs, the function will check whether there are alarms such as power supply or fan, etc.; filtered_alerts is used to store alarm data that meets the correlation conditions, that is, to store the training alarm data set; current_time_window is used to store alarm data in the current time window, that is, to store a subset of the original alarm data; last_time_stamp is used to record the starting timestamp of the current time window. The acquisition process of the training alarm data set can be as follows: traverse each alarm data in the original alarm data set; for each alarm data, check whether it belongs to the current time window; if it does, add it to the current_time_window, and then check whether the current_time_window is full, that is, check whether it has reached the size specified by window_size_time; if it is full, use time_range_condition to check whether the alarm data in the time window meets the time range condition, and if it does, use alert_correlation_condition to further check the correlation between the alarm data; if the alarm data meets the correlation condition, add the alarm data of the entire time window to filtered_alerts; if the timestamp of the current alarm data exceeds the end time of the current time window, that is, exceeds last_time_stamp+window_size_time, clear the current_time_window and update last_time_stamp to start a new time window. After traversing all the alarm data, check and process the possible remaining current_time_window, that is, process the current_time_window that is not empty and meets the conditions.

[0094] Step S104: Process all initial alarm types to obtain target alarm types.

[0095] Step S105: forwarding target alarm data consistent with the target alarm type.

[0096] In actual applications, after obtaining a preset number of initial alarm types, all initial alarm types can be processed to obtain the target alarm type, so as to determine the target alarm type by integrating the alarm forwarding recognition capabilities of all alarm forwarding decision trees, and then forward the target alarm data consistent with the target alarm type.

[0097] It should be noted that the method of processing all initial alarm types can be flexibly determined according to the application scenario of alarm forwarding. For example, the initial alarm types can be voted on, and the initial alarm type with the most votes can be selected as the target alarm type, etc. Of course, the initial alarm types can also be weighted, and the target alarm type can be determined based on the results of the weighted calculation.

[0098] In practical applications, after obtaining a training alarm data subset for training an alarm forwarding decision tree, in the process of obtaining a corresponding alarm forwarding decision tree based on each group of training alarm data subsets, for each group of training alarm data subsets, the training alarm data subset can be divided into a first alarm data subset and a second alarm data subset; a decision tree quantity value and a split attribute value are randomly generated, the decision tree quantity value is used to determine the number of decision trees generated, and the split attribute value is used to determine the number of split attributes of the decision tree; according to the decision tree quantity value and the split attribute value, the first alarm data subset is used to generate an original decision tree; the second alarm data subset is used to generate a fitness value of the original decision tree, and the fitness value is used to characterize the forwarding recognition capability of the generated original decision tree for the alarm data, which can be the forwarding recognition accuracy of the original decision tree for the alarm data, etc. For example, the fitness value can be expressed as , F represents the fitness value, represents the predicted category label of the original decision tree for the kth sample, represents the measured value of the kth sample, represents the indicator function, when hour, is 1, when hour, is 0, Represents the total number of samples of the second alarm data subset; the original decision tree is selected according to the fitness value to obtain the alarm forwarding decision tree. For example, when the type of fitness value is recognition accuracy, the original decision tree with the largest fitness value is used as the alarm forwarding decision tree, etc. Of course, the first few original decision trees with the largest fitness values ​​can also be used as alarm forwarding decision trees, etc.

[0099] From this implementation process, it can be seen that in the process of obtaining an alarm forwarding decision tree based on training an alarm data subset, the present invention first divides the training alarm data subset into a first alarm data subset and a second alarm data subset, so that the decision tree can be trained with the help of the first alarm data subset, and the function of the trained decision tree can be verified with the help of the second alarm data subset, laying a good foundation for improving the training accuracy of the alarm forwarding decision tree; then, the number of decision trees and the number of splitting attribute values ​​are randomly generated, and the first alarm data subset is used to generate the decision tree according to the number of decision trees and the number of splitting attribute values. The original decision tree is formed, and the fitness value of the original decision tree is generated by applying the second alarm data subset. The original decision tree is selected according to the fitness value to obtain the alarm forwarding decision tree. Since the number of decision trees and the number of split attributes are randomly generated, and the number of decision trees and the number of split attributes determine the recognition performance of the decision tree, the present invention is equivalent to generating a decision tree with random recognition ability to screen out the alarm forwarding decision tree, so as to obtain the alarm forwarding decision tree with strong recognition ability in a random manner, and obtain the alarm forwarding decision tree with good recognition ability while reducing the difficulty of decision tree training.

[0100] It should be noted that the structure of a decision tree includes a root node, internal nodes, branches, and leaf nodes. The root node is the starting point of the tree, representing the entire data set, and all decisions start from this node. Each internal node represents a test of a feature or attribute, and the data set is divided into different subsets based on the value of the feature. Branches connect each node, representing different values ​​of the feature, and each branch points to the node of the next layer, that is, to an internal node or leaf node. The leaf node represents the final decision result, which is usually a classification label for classification problems and a predicted value for regression problems. The construction and optimization of decision trees involve processes such as feature selection, initialization, tree construction and iterative optimization, pruning and convergence. Feature selection refers to the selection of features that can effectively segment the data set. The criteria include information gain, information gain rate and Gini index. Initialization refers to the need to set some initial parameters before building a decision tree, such as randomly selecting features, split points and tree depth. The selection of these parameters aims to explore a variety of possible decision tree structures. Tree construction and iterative optimization refers to starting from the root node, segmenting according to the currently selected features, creating internal nodes, and dividing the data set into subsets. Feature selection and node creation are performed recursively for each subset, and an iterative optimization strategy is adopted. Parameters such as feature selection and split points are continuously adjusted to explore a better decision tree structure, and the goal of iterative optimization is to improve the performance of the decision tree on the validation set, such as accuracy and recall rate. Pruning refers to the pruning operation during or after the tree construction process to prevent overfitting. It can include pre-pruning and post-pruning. Pre-pruning is to stop the splitting during the construction process if the splitting does not bring significant performance improvement. Post-pruning is to evaluate the performance of each subtree after the construction is completed, and remove some unimportant branches to simplify the tree structure. Convergence refers to when the iterative optimization process reaches the preset stopping conditions, such as when the number of iterations and the performance improvement are no longer significant, the decision tree is considered to have converged to a better structure.

[0101] In a specific application scenario, in the process of randomly generating the number of decision trees ntree and the number of splitting attributes mtry, the first value range of the number of decision trees can be determined; the second value range of the splitting attribute value can be determined, such as the first value range is [1, 500], the second value range is [1, 20], etc.; the positions and velocities of the second number of particles are initialized, and the position of each particle is determined according to the first value range and the second value range. For example, the horizontal coordinate of the particle position can be determined according to the first value range, and the vertical coordinate of the particle position can be determined according to the second value range. For example, the particle position is initialized as (ntree=3, mtry=2 ); according to the initialization position and initialization speed of the particle, generate the position and speed of the particle in the current round; convert the position of the particle in the current round into the number of decision trees and the number of split attributes of the current round, for example, use the horizontal coordinate of the position of the particle in the current round as the number of decision trees in the current round, and use the vertical coordinate of the position of the particle in the current round as the number of split attributes of the current round; correspondingly, in the process of generating the original decision tree according to the number of decision trees and the number of split attributes by applying the first alarm data subset, the original decision tree can be generated according to the number of decision trees and the number of split attributes of the current round.

[0102] In a specific application scenario, after applying the second subset of alarm data to generate the fitness value of the original decision tree, the local optimal position of each particle can be updated according to the fitness value, and the global optimal position can be updated. For example, for each particle, when the fitness value of the decision tree converted by the particle position is the largest, the particle position is used as the local optimal position of the particle. Similarly, for all particles, when the fitness value of the decision tree converted by the particle position is the largest, the particle position is used as the global optimal position. It is judged whether the set termination condition is met. The termination condition may be that the maximum number of iterations is reached or the fitness value reaches the set requirement, such as reaching the maximum number of iterations of 200 or the fitness value is greater than 90%. In response to not meeting the set termination condition, returning to the step of generating the position and speed of the particle in the current round according to the initialization position and initialization speed of the particle, so as to update the position and speed of the particle in the current round in an iterative manner. In response to meeting the set termination condition, it ends. Correspondingly, in the process of selecting the original decision tree according to the fitness value to obtain the alarm forwarding decision tree, the decision tree corresponding to the last recorded local optimal position can be determined as the alarm forwarding decision tree.

[0103] In a specific application scenario, in the process of updating the local optimal position of each particle according to the fitness value and updating the global optimal position, for a single particle, all positions of the particle can be first converted into corresponding decision tree quantity values ​​and split attribute quantity values, and the first alarm data subset is used to generate the original decision tree according to the decision tree quantity value and split attribute quantity value corresponding to each position, and the second alarm data subset is used to generate the forwarding recognition accuracy of the original decision tree, and then the original decision tree with the highest forwarding recognition accuracy is used as the local optimal decision tree, and the position corresponding to the local optimal decision tree is determined as the local optimal position of the particle; the forwarding recognition accuracy of all particles is compared, and the original decision tree with the highest forwarding recognition accuracy is used as the global optimal decision tree, and then the position corresponding to the global optimal decision tree is determined as the global optimal position.

[0104] From the implementation process, it can be seen that for a single particle, the present invention first converts all positions of the particle into corresponding decision tree quantity values ​​and split attribute value numbers, and then generates the original decision tree and the forwarding recognition accuracy of the original decision tree according to the decision tree quantity values ​​and split attribute value numbers corresponding to each position. In this way, the position of the particle can be screened with the help of the forwarding recognition accuracy to obtain the local optimal position of the particle, that is, the original decision tree with the highest forwarding recognition accuracy can be used as the local optimal decision tree, and then the position corresponding to the local optimal decision tree is determined as the local optimal position of the particle. In this way, the local optimal position that is helpful for alarm forwarding recognition can be accurately and quickly screened out from all positions of a single particle with the help of the forwarding recognition accuracy; and then it is only necessary to compare the forwarding recognition accuracy rates of all particles, take the original decision tree with the highest forwarding recognition accuracy rate as the global optimal decision tree, and then determine the position corresponding to the global optimal decision tree as the global optimal position, so that the global optimal position can be quickly determined only by comparing the forwarding recognition accuracy rates of all particles, thereby improving the recognition efficiency and accuracy of the local optimal position and the global optimal position.

[0105] In a specific application scenario, in the process of generating the position and speed of the particle in the current round according to the initialization position and initialization speed of the particle, a drift coefficient and an attractor can be generated; the group average optimal position of the particle is generated according to the local optimal position of the particle in the previous round; the speed of the particle in the current round is generated according to the group average optimal position, the drift coefficient, the attractor and the position of the particle in the previous round; the position of the particle in the current round is generated according to the position of the particle in the previous round and the speed of the particle in the current round, for example, the sum of the position of the particle in the previous round and the speed of the particle in the current round is used as the position of the particle in the current round, etc.; wherein, when the current round is the first round, the position of the particle in the previous round is the initialization position, and the speed of the particle in the previous round is the initialization speed.

[0106] In specific application scenarios, in the process of generating drift coefficients and attractors, the first constant can be generated and the second constant , whose values ​​can all be 2, etc.; Generate the first random number and the second random number , t represents the number of iterations, i represents the number of particles, j represents the dimension of the position, and the first random number and the second random number can be random numbers uniformly distributed in the interval (0, 1), etc.; according to the first constant, the second constant, the first random number and the second random number, the drift coefficient is generated ; According to the first constant, the second constant, the first random number, the second random number, and the global optimal position of the previous round and the local optimal position of the particle in the previous round , generating attractors .

[0107] In specific application scenarios, when generating the velocity of particles in the current round based on the average optimal position of the group, the drift coefficient, the attractor, and the position of the particles in the previous round, the average optimal position of the group can be used to calculate the velocity of the particles in the current round. and the particle's position in the previous round , generating a Gaussian distribution with standard deviation ,for example etc., among which, , N represents the total number of particles; generate Gaussian distribution function ; Generate the difference between the attractor and the particle's position in the previous round, for example, the difference is ; Generate the particle speed in the current round based on the drift coefficient, difference, Gaussian distribution standard deviation and Gaussian distribution function ,for example .

[0108] It should be noted that the derivation process of particle position and velocity update is as follows: Assume that the directional drift motion velocity of the i-th particle of the (t+1)th generation in the j-th dimension is expressed as , the random diffusion velocity is expressed as , then the speed of the (t+1)th generation particle is The update formula is expressed as ; Assuming the directional drift motion speed for , , represents a constant, Indicates the current best position of the i-th particle; Indicates the current optimal position of all individual particles; represents the current position of the ith particle of the tth generation in the jth dimension; the directional drift motion speed can be expressed as , , , represents the drift coefficient; Represents the attractor; Based on the Maxwell rate distribution rate of random motion, the random motion speed is defined for , represents the Gaussian distribution function, represents the standard deviation of the Gaussian distribution, , represents the average value of the historical optimal positions of all individual particles in the current particle swarm, that is, , N represents the size of the group, Rewrite as In summary, the particle velocity and position update formula is expressed as , .

[0109] The present invention provides an alarm forwarding method, which obtains target alarm data; determines a preset number of pre-trained alarm forwarding decision trees; identifies the target alarm data based on each alarm forwarding decision tree to obtain the initial alarm type of the alarm to be forwarded; processes all initial alarm types to obtain the target alarm type; and forwards the target alarm data consistent with the target alarm type; wherein the value of the preset number is greater than or equal to 2. The beneficial effects of the present invention are as follows: a preset number of alarm forwarding decision trees are pre-trained, and each alarm forwarding decision tree can identify the target alarm data to obtain the initial alarm type of the alarm to be forwarded, that is, a preset number of alarm forwarding decision trees can be applied to automatically obtain a preset number of initial alarm types, without the need to manually set the alarm forwarding, and without the need to query the alarm forwarding strategy, thereby improving the efficiency of alarm forwarding; and after obtaining the preset number of initial alarm types, all initial alarm types need to be processed to obtain the target alarm type, and then the target alarm data consistent with the target alarm type is forwarded, which is equivalent to screening multiple initial alarm types to obtain the target alarm type, and realizes the forwarding of the target alarm data by comprehensively considering the identification results of multiple alarm forwarding decision trees. Compared with the application of a single alarm forwarding strategy to forward the alarm, the screening criteria for alarm forwarding are refined and the accuracy of alarm forwarding is improved. In addition, there is no need to store alarm data in the database, which effectively saves database storage space and greatly reduces the number of database queries, thereby significantly optimizing the software's operating efficiency. Users can obtain accurate and comprehensive alarm information without manually configuring complex forwarding rules, allowing for better troubleshooting and equipment management.

[0110] In order to understand the alarm forwarding solution provided by the present invention, assuming that the alarm data of the server is forwarded, the process can be as follows:

[0111] Generate 3 training subsets. Assume that subset 1 includes sample 1, sample 2, sample 3, sample 4, and sample 1; subset 2 includes sample 5, sample 6, sample 7, sample 7, and sample 8; subset 3 includes sample 9, sample 10, sample 2, sample 3, and sample 4. The samples are shown in Table 1, including: alarm name, alarm level, IP, location, confirmation status, details, first occurrence time, last occurrence time, and carried information, etc.

[0112] Use subset 1 to train decision tree 1, use subset 2 to train decision tree 2, and use subset 3 to train decision tree 3;

[0113] When new alarm data is received, it is input into the three decision trees to obtain the prediction results of each decision tree for the forwarded alarm; for example, the prediction result of decision tree 1 is "need to carry CPU status information", the prediction result of decision tree 2 is "no need to carry CPU status information", and the prediction result of decision tree 3 is "need to carry CPU status information", etc.;

[0114] Through voting, the final result is "need to carry CPU status information", and then the alarm carrying CPU status information can be forwarded.

[0115] Table 1 Alarm data diagram

[0116]

[0117] To further understand this solution, assume that there is an infrastructure management platform that integrates device management and alarm monitoring functions, and has the ability to forward alarms to third-party IP (Internet Protocol) addresses. Initially, the platform directly forwards the original alarm information without additional details. To improve the richness and practicality of alarm information, the platform allows users to select the information to be forwarded from a series of extended fields when configuring the alarm forwarding strategy, including but not limited to the original alarm content and the specific component status of the device, such as the CPU status of the server. This approach significantly increases the amount of alarm information, facilitates users to directly understand the device status, and gives users the flexibility to customize the forwarded content. However, given the large number of devices managed by the platform and their unique characteristics, a single check logic is difficult to apply to all scenarios, which may lead to information redundancy and reduce alarm efficiency. In addition, ordinary users often find it difficult to accurately determine which information is most critical for troubleshooting. Therefore, by applying the intelligent method based on decision tree provided by the present invention to optimize alarm forwarding, the massive historical alarm data accumulated by the platform can be fully utilized as a training set to construct a decision tree model. The core task of the decision tree is to predict which device component status information should be included in the forwarding content under a specific alarm scenario, such as whether the CPU or memory status information of the server needs to be forwarded. By deeply analyzing the correlation and trends between historical alarms, the decision tree can learn and identify the patterns and precursors of equipment failures, such as a server frequently generating power alarms within a short period of time after a memory alarm. Based on this, when the platform receives a memory alarm from the server again, the decision tree can intelligently predict and recommend the inclusion of power status information to enhance the user's early warning capabilities for potential equipment failures. This strategy not only reduces unnecessary database query operations, but also eliminates the burden of storing complex forwarding rules, thereby realizing the intelligence and automation of the alarm forwarding process.

[0118] The present invention also provides an electronic device and a computer-readable storage medium, both of which have the corresponding effects of the alarm forwarding method provided in the embodiment of the present invention. Figure 2 , Figure 2 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

[0119] An electronic device provided by an embodiment of the present invention includes a memory 201 and a processor 202. The memory 201 stores a computer program. When the processor 202 executes the computer program, the steps of the alarm forwarding method described in any of the above embodiments are implemented.

[0120] See also Figure 3Another electronic device provided in an embodiment of the present invention may also include: an input port 203 connected to the processor 202, used to transmit commands input from the outside to the processor 202; a display unit 204 connected to the processor 202, used to display the processing results of the processor 202 to the outside; a communication module 205 connected to the processor 202, used to realize communication between the electronic device and the outside. The display unit 204 can be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module 205 includes but is not limited to mobile high-definition link technology (Mobile High-Definition Link, MHL), Universal Serial Bus (Universal Serial Bus, USB), High-Definition Multimedia Interface (High-Definition Multimedia Interface, HDMI), wireless connection: wireless fidelity technology (WIreless Fidelity, WiFi), Bluetooth communication technology, low-power Bluetooth communication technology, and communication technology based on IEEE802.11s.

[0121] An embodiment of the present invention provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the alarm forwarding method described in any of the above embodiments are implemented.

[0122] The computer-readable storage medium involved in the present invention includes random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM (Compact Disc Read-Only Memory), or any other form of storage medium known in the technical field.

[0123] A computer program product provided by an embodiment of the present invention includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the alarm forwarding method described in any of the above embodiments are implemented.

[0124] For the description of the relevant parts in the computer-readable storage medium of an electronic device and a computer program product set provided by an embodiment of the present invention, please refer to the detailed description of the corresponding parts in the alarm forwarding method provided by an embodiment of the present invention, which will not be repeated here. In addition, the parts of the above technical solutions provided by the embodiments of the present invention that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0125] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0126] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An alarm forwarding method, characterized in that: include: Obtain target warning data; Determine a preset number of pre-trained alarm forwarding decision trees; Identifying the target alarm data based on each of the alarm forwarding decision trees to obtain an initial alarm type of the alarm to be forwarded; Processing all the initial alarm types to obtain a target alarm type; forwarding the target alarm data consistent with the target alarm type; Wherein, the value of the preset number is greater than or equal to 2.

2. The alarm forwarding method according to claim 1, characterized in that: Before determining the pre-trained preset number of alarm forwarding decision trees, it also includes: Obtain a training alarm data set; Randomly selecting a first number of training alarm data from the training alarm data set to obtain a set of training alarm data subsets; Count the number of groups of training alarm data subsets; In response to the number of groups of the training alarm data subset being less than the preset number, returning to execute the step of randomly selecting a target number of training alarm data from the training alarm data set; In response to the number of groups of the training alarm data subsets being equal to the preset number, a corresponding alarm forwarding decision tree is obtained by training based on each group of the training alarm data subsets.

3. The alarm forwarding method according to claim 2, characterized in that: Get the training alarm data set, including: Obtain the original alarm data set; In the original alarm data set, relevant alarm data in the same time period are used as training alarm data sets.

4. The alarm forwarding method according to claim 3, characterized in that: In the original alarm data set, alarm data in the same time period and related to each other are used as a training alarm data set, including: Determine the target time period; For each alarm data in the original alarm data set, if the alarm data belongs to the target time period, adding the alarm data to the original alarm data subset corresponding to the target time period; Determining whether the alarm data in the original alarm data subset meets the correlation condition; In response to the alarm data in the original alarm data subset satisfying the correlation condition, the original alarm data subset is used as a training alarm data set.

5. The alarm forwarding method according to claim 4, characterized in that: Before determining whether the alarm data in the original alarm data subset meets the correlation condition, the method further includes: Determining whether the alarm data in the original alarm data subset is within a set time range; In response to the alarm data in the original alarm data subset being within a set time range, a step of determining whether the alarm data in the original alarm data subset meets a correlation condition is performed.

6. The alarm forwarding method according to claim 4, characterized in that: For each alarm data in the original alarm data set, if the alarm data belongs to the target time period, the alarm data is added to the original alarm data subset corresponding to the target time period, including: Generate a current time window corresponding to the target time period; For each alarm data in the original alarm data set, if the alarm data belongs to the current time window, the alarm data is added to the original alarm data subset corresponding to the current time window.

7. The alarm forwarding method according to claim 2, characterized in that: Based on each group of training alarm data subsets, the corresponding alarm forwarding decision tree is trained, including: For each set of training alarm data subsets, dividing the training alarm data subsets into a first alarm data subset and a second alarm data subset; Randomly generate the number of decision trees and the number of split attributes; According to the number of decision trees and the number of splitting attributes, the first subset of alarm data is used to generate an original decision tree; Using the second subset of alarm data to generate a fitness value of the original decision tree; The original decision tree is selected according to the fitness value to obtain an alarm forwarding decision tree.

8. The alarm forwarding method according to claim 7, characterized in that: Randomly generate decision tree quantity values ​​and split attribute value, including: Determine a first value range of the decision tree quantity value; Determine a second value range of the split attribute value; Initializing the positions and velocities of the second number of particles, wherein the position of each particle is determined according to the first value range and the second value range; Generate the position and speed of the particle in the current round according to the initial position and initial speed of the particle; Convert the particle position in the current round into the number of decision trees and the number of split attributes in the current round; According to the number of decision trees and the number of splitting attributes, the first subset of alarm data is used to generate an original decision tree, including: According to the number of decision trees in the current round and the number of split attributes in the current round, the first alarm data subset is used to generate an original decision tree.

9. The alarm forwarding method according to claim 8, characterized in that: After applying the second subset of alarm data to generate the fitness value of the original decision tree, the method further includes: According to the fitness value, updating the local optimal position of each particle and updating the global optimal position; In response to not meeting the set termination condition, returning to the step of generating the position and velocity of the particle in the current round according to the initialization position and initialization velocity of the particle; In response to satisfying the set termination condition, the process ends; The original decision tree is selected according to the fitness value to obtain an alarm forwarding decision tree, including: The decision tree corresponding to the last recorded local optimal position is determined as the alarm forwarding decision tree.

10. The alarm forwarding method according to claim 9, characterized in that: According to the initial position and initial velocity of the particle, the position and velocity of the particle in the current round are generated, including: Generate drift coefficients and attractors; Generate the average optimal position of the particle group based on the local optimal position of the particle in the previous round; Generate the particle speed in the current round based on the group average optimal position, drift coefficient, attractor and the particle position in the previous round; Generate the position of the particle in the current round according to the position of the particle in the previous round and the speed of the particle in the current round; Among them, when the current round is the first round, the position of the particle in the previous round is the initialization position, and the speed of the particle in the previous round is the initialization speed.

11. The alarm forwarding method according to claim 10, characterized in that: Generate drift coefficients and attractors, including: generating a first constant and a second constant; Generate a first random number and a second random number; Generate a drift coefficient according to the first constant, the second constant, the first random number, and the second random number; An attractor is generated according to a first constant, a second constant, a first random number, a second random number, a global optimal position of a previous round, and a local optimal position of a particle in the previous round.

12. The alarm forwarding method according to claim 11, characterized in that: Generate the velocity of the particle in the current round based on the group average optimal position, drift coefficient, attractor and the position of the particle in the previous round, including: Generate the Gaussian distribution standard deviation based on the average optimal position of the group and the position of the particle in the previous round; Generate a Gaussian distribution function; Generate the difference between the attractor and the particle's position in the previous round; Generate the particle speed in the current round based on the drift coefficient, difference, Gaussian distribution standard deviation and Gaussian distribution function.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the alarm forwarding method as claimed in any one of claims 1 to 12 are implemented.

14. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the alarm forwarding method as claimed in any one of claims 1 to 12 when executing the computer program.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the alarm forwarding method according to any one of claims 1 to 12 are implemented.

Images