Alarm handling method, computer program product and electronic device

Abstract

The invention provides an alarm processing method, a computer program product and electronic equipment. The method comprises the following steps: receiving alarm information; determining whether the alarm information needs to be filtered; under the condition that the alarm information does not need to be filtered, the Euclidean distance corresponding to each online attending person is determined according to the busy degree, the fatigue degree and the alarm processing timeliness corresponding to each online attending person, the busy degree represents the number of historical alarm information which is not processed in the hands of the online attending person, and the fatigue degree represents the fatigue degree of the online attending person. The fatigue represents the online time of the online guarding personnel, and the alarm processing timeliness represents the timeliness of the online guarding personnel for processing historical alarm information; according to each Euclidean distance, determining a target attending person, the target attending person being one of a plurality of online attending persons; and distributing the alarm information to the target attending personnel so as to dispose the alarm information. According to the invention, the problem of frequent overtime alarm processing or unmanned alarm processing caused by the absence of a reasonable alarm distribution rule in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of alarm technology, and in particular, to an alarm handling method, a computer-readable storage medium, a computer program product, and an electronic device. Background Art

[0002] The bank security system needs to receive and process alarm / event messages from alarm hosts, encoding devices, access control devices, intercom devices, and firefighting equipment, and requires the monitoring center staff to receive alarm messages in a timely manner and make corresponding processing. At present, due to the wide distribution of outlets involved in the alarm field of bank security, the variety of equipment types and brands, the number of alarm messages is huge, and there is no reasonable distribution method for alarm messages, resulting in the alarm often not being processed in time, and the alarm history records are difficult to track.

[0003] At present, the alarm system of bank security is relatively crude in handling alarms. It simply receives alarm messages, and employees log in to the system to view historical alarms and handle them. According to the survey, the vast majority of domestic banks do not have an effective alarm distribution method. Take a large commercial bank as an example. There is no reasonable distribution rule and alarm balancer for alarm messages. It completely implements "whoever finds it, handles it", and does not take into account the importance of the alarm and the processing time. It is very likely that important alarms will not be handled in time. Therefore, there is no reasonable alarm distribution rule in the existing technology, which leads to frequent timeouts for alarm handling or no one handling the alarm. Summary of the invention

[0004] The main purpose of the present application is to provide an alarm handling method, a computer-readable storage medium, a computer program product and an electronic device, so as to at least solve the problem in the prior art that there is no reasonable alarm allocation rule, resulting in frequent alarm handling timeouts or no one handling the alarm.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an alarm handling method is provided, including: receiving alarm information; determining whether the alarm information needs to be filtered; if the alarm information does not need to be filtered, determining the Euclidean distance corresponding to each online duty personnel according to the busyness, fatigue and alarm handling timeliness corresponding to each online duty personnel, the busyness represents the number of unhandled historical alarm information in the hands of the online duty personnel, the fatigue represents the online time of the online duty personnel, and the alarm handling timeliness represents the timeliness of the online duty personnel handling the historical alarm information; determining the target duty personnel according to each of the Euclidean distances, the target duty personnel being one of the multiple online duty personnel; and assigning the alarm information to the target duty personnel to handle the alarm information.

[0006] Optionally, determining a target on-duty personnel according to each of the Euclidean distances includes: determining the online on-duty personnel corresponding to the smallest Euclidean distance among the Euclidean distances as the target on-duty personnel.

[0007] Optionally, before determining the Euclidean distance corresponding to each online attendant according to the busyness, fatigue and alarm handling timeliness corresponding to each online attendant, the method further includes: determining the busyness as Among them, a n Indicates the number of historical alarm messages of level n that have not been handled by the online on-duty personnel, α n represents the preset first weight, n represents the level of the historical alarm information, x

[0008] Indicates the busyness; determines the fatigue level as y=γb, wherein γ represents the preset second weight, b represents the number of consecutive online hours of the online attendant, and y represents the fatigue level; determines the timeliness of alarm handling as z=ζ(deal / total), wherein ζ represents the preset third weight, total represents the total number of historical alarm messages handled by the online attendant, deal represents the number of historical alarm messages handled by the online attendant and handled in time, and alarm handling represents the timeliness of alarm handling.

[0009] Optionally, according to the busyness, fatigue and alarm handling timeliness of each online attendant, determining the Euclidean distance corresponding to each online attendant includes: determining the Euclidean distance as Among them, |X| represents the Euclidean distance, x represents the busyness, y represents the fatigue, and alarm handling represents the timeliness of the alarm handling.

[0010] Optionally, determining whether the alarm information needs to be filtered includes: using a sliding window to determine that the sum of the number of first target alarm information and the number of alarm information within a threshold time length is the target number, the first target alarm information represents the historical alarm information whose alarm type is the same as the alarm type of the alarm information and the alarm device is the same as the alarm device of the alarm information, and the alarm device represents the device that issues the alarm information or the historical alarm information; determining whether the target number is greater than a threshold number; if the target number is greater than the threshold number, determining that the alarm information needs to be filtered; if the target number is not greater than the threshold number, determining that the alarm information does not need to be filtered.

[0011] Optionally, the method also includes: when the alarm information needs to be filtered, filtering the alarm information, and filtering out second target alarm information received within a first preset time period, the second target alarm information representing future alarm information whose alarm type is the same as the alarm type of the alarm information and whose alarm device is the same as the alarm device of the alarm information, and the alarm device representing the device that issues the alarm information or the future alarm information.

[0012] Optionally, after assigning the alarm information to the target on-duty personnel, the method further includes: determining whether the alarm information has been handled by the target on-duty personnel within a second preset time period; if the alarm information has not been handled by the target on-duty personnel within the second preset time period, reporting the alarm information to a superior monitoring center.

[0013] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the alarm handling methods.

[0014] According to another aspect of the present application, a computer program product is provided, comprising computer instructions, wherein when the computer instructions are executed by a processor, any one of the alarm handling methods is implemented.

[0015] According to another aspect of the present application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include means for executing any one of the alarm handling methods.

[0016] By applying the technical solution of the present application, the alarm information is first received, and then it is determined whether the alarm information needs to be filtered. When the alarm information does not need to be filtered, the Euclidean distance corresponding to each online on-duty personnel is determined according to the busyness, fatigue and alarm handling timeliness of each online on-duty personnel, and then the target on-duty personnel is determined according to each Euclidean distance, and finally the alarm information is allocated to the target on-duty personnel to handle the alarm information. Compared with the problem that there is no reasonable alarm allocation rule in the prior art, which leads to frequent timeout of alarm handling or no one handling the alarm, the present application calculates the busyness, fatigue and alarm handling timeliness of the online on-duty personnel, and determines the Euclidean distance based on these parameters, so that the alarm information can be more reasonably allocated to the most suitable on-duty personnel, ensuring that the workload of each on-duty personnel is relatively balanced, ensuring the fairness of the on-duty personnel in handling the alarm, and can adapt to the changes in the status of the on-duty personnel, adjust the allocation of the alarm information in real time, realize the efficient and reasonable allocation of the alarm information, and improve the efficiency and quality of the alarm handling; in addition, by determining whether the alarm information needs to be filtered, unnecessary processing procedures can be reduced and the efficiency of the alarm handling can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 A hardware structure block diagram of a mobile terminal for executing an alarm handling method provided in an embodiment of the present application is shown;

[0019] Figure 2 A schematic diagram of a process of an alarm handling method provided according to an embodiment of the present application is shown;

[0020] Figure 3 A schematic diagram of Euclidean distance in an alarm handling method provided according to an embodiment of the present application is shown;

[0021] Figure 4 A schematic diagram of a sliding window in an alarm handling method provided according to an embodiment of the present application is shown;

[0022] Figure 5 A schematic flow chart of a complete alarm handling method provided according to an embodiment of the present application is shown.

[0023] The above drawings include the following reference numerals:

[0024] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0025] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0026] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] As introduced in the background technology, there is no reasonable alarm allocation rule in the prior art, which leads to frequent alarm handling timeouts or no one handling the alarm. To solve the above problems, the embodiments of the present application provide an alarm handling method, a computer-readable storage medium, a computer program product and an electronic device.

[0029] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0030] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of an alarm handling method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0031] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the alarm handling method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0032] In this embodiment, an alarm handling method running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] Figure 2 Flowchart of the alarm handling method according to the embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0034] Step S201, receiving alarm information;

[0035] Step S202, determining whether the alarm information needs to be filtered;

[0036] Step S203, when the alarm information does not need to be filtered, the Euclidean distance corresponding to each online attendant is determined according to the busyness, fatigue and alarm handling timeliness corresponding to each online attendant, wherein the busyness represents the number of unhandled historical alarm information in the hands of the online attendant, the fatigue represents the online time of the online attendant, and the alarm handling timeliness represents the timeliness of the online attendant handling the historical alarm information;

[0037] Step S204, determining a target on-duty person according to each of the above-mentioned Euclidean distances, wherein the above-mentioned target on-duty person is one of the above-mentioned multiple online on-duty persons;

[0038] Step S205: distribute the alarm information to the target on-duty personnel to handle the alarm information.

[0039] Through the above embodiment, the alarm information is first received, and then it is determined whether the alarm information needs to be filtered. When the alarm information does not need to be filtered, the Euclidean distance corresponding to each online on-duty personnel is determined according to the busyness, fatigue and alarm handling timeliness of each online on-duty personnel, and then the target on-duty personnel is determined according to each Euclidean distance, and finally the alarm information is allocated to the target on-duty personnel to handle the alarm information. Compared with the problem that there is no reasonable alarm allocation rule in the prior art, which leads to frequent timeout of alarm handling or no one handling the alarm, the present application calculates the busyness, fatigue and alarm handling timeliness of the online on-duty personnel, and determines the Euclidean distance based on these parameters, so that the alarm information can be more reasonably allocated to the most suitable on-duty personnel, ensuring that the workload of each on-duty personnel is relatively balanced, ensuring the fairness of the on-duty personnel in handling the alarm, and can adapt to the changes in the status of the on-duty personnel, adjust the allocation of alarm information in real time, realize the efficient and reasonable allocation of alarm information, and improve the efficiency and quality of alarm processing; in addition, by determining whether the alarm information needs to be filtered, unnecessary processing procedures can be reduced and the efficiency of alarm handling can be improved.

[0040] In an optional solution, determining the target on-duty personnel according to each of the above-mentioned Euclidean distances includes: determining the online on-duty personnel corresponding to the smallest Euclidean distance among the above-mentioned Euclidean distances as the target on-duty personnel. In this embodiment, by selecting the online on-duty personnel with the smallest Euclidean distance, it can be further ensured that the alarm information is assigned to the online on-duty personnel who is currently most suitable for processing the information, thereby optimizing the use of human resources and being able to further respond to and process the alarm more quickly.

[0041] According to some exemplary embodiments of the present application, before determining the Euclidean distance corresponding to each of the online on-duty personnel according to the busyness, fatigue and alarm handling timeliness corresponding to each of the online on-duty personnel, the method further includes: determining the busyness as Among them, a n Indicates the number of level n in the above historical alarm information that has not been handled by the online on-duty personnel, α n represents the preset first weight, n represents the level of the above historical alarm information, and x represents the above busyness; the above fatigue is determined as y=γb, wherein γ represents the preset second weight, b represents the number of hours that the above online attendant is continuously online, and y represents the above fatigue; the above alarm handling timeliness is determined as z=ζ(deal / total), wherein ζ represents the preset third weight, total represents the total number of the above historical alarm information that has been handled by the above online attendant, deal represents the number of the above historical alarm information that has been handled and handled in time by the above online attendant, and alarm handling represents the above alarm handling timeliness. In this embodiment, a specific formula is used to ensure that the obtained busyness, fatigue and alarm handling timeliness are relatively accurate, and the subsequently obtained Euclidean distance is relatively accurate, so that the evaluation of the online attendant is more objective and accurate, thereby ensuring that the determined target attendant is relatively accurate, and further ensuring that the allocation of alarm information is relatively accurate.

[0042] Specifically, first of all, the alarms are divided into five levels according to their importance and priority. Level 1 (access control coercion, emergency button, etc.) is the most important, and level 5 is the least important (access control card swiping, self-service bank incoming reminder, etc., generally level 5 alarms are automatically polled and played on the wall without manual processing). This method needs to allocate the alarms to each online duty officer fairly and quickly, assuming that the online duty officers will handle the alarms in time after receiving them (the monitoring center will count the number of alarms handled, the alarm level and the timeliness, and have corresponding reward and punishment measures).

[0043] It should be noted that whether the online staff handles historical alarm information in a timely manner needs to be determined based on the bank's security policy and actual situation. A standard time for "timely" alarm processing is required. This time can be a few seconds, a few minutes, or longer, depending on the type and urgency of the alarm. For example, an alarm triggered by an emergency button may require a response within 30 seconds, while an access control alarm may allow a response time of 1-2 minutes.

[0044] In actual application, technicians in this field can set the first weight, the second weight and the third weight based on empirical values, or obtain them through multiple experiments. This application does not impose any specific restrictions on this.

[0045] Specifically, a nRepresents the number of level n alarms, α n Represents the weight of the n-level alarm; γ represents the fatigue weight, which has different values ​​during the day and at night.

[0046] In other embodiments, according to the busyness, fatigue and alarm handling timeliness of each online attendant, the Euclidean distance corresponding to each online attendant is determined, including: determining the Euclidean distance as Wherein, |X| represents the Euclidean distance, x represents the busyness, y represents the fatigue, and alarm handling represents the timeliness of alarm handling. In this embodiment, by quantifying the busyness, fatigue and alarm handling timeliness of the online attendant into numerical values, the working status and efficiency of each online attendant can be further evaluated more objectively, which further ensures that the target attendant is determined more accurately and the distribution of alarm information is more accurate.

[0047] Specifically, the core of the alarm assignment method is the Euclidean distance, such as Figure 3 As shown, the X, Y, and Z coordinates each represent an alarm allocation factor. The alarm allocation factors of this application include: busyness x, fatigue y, and alarm handling timeliness z; the origin O represents the on-duty personnel who have just come online, whose x, V, and z are all 0, and the alarm is allocated to him first. As the number of alarms at all levels and the online time of the online on-duty personnel change, their position in space changes continuously. New alarms will only be allocated to the on-duty personnel closest to the origin. The distance formula from the on-duty personnel to the origin is: Among them, A(a x , a y , a z , B(b x , b y , b z ) represents two online duty personnel in the coordinates.

[0048] In summary, the method of alarm allocation is: a) After handling the alarm and automatically calculating the Euclidean distance (i.e., Euclidean distance) of the online duty personnel every hour; b) When the system receives a new alarm, select the online duty personnel with the smallest current Euclidean distance and assign the alarm to him; c) Recalculate the Euclidean distance of the online duty personnel.

[0049] Specifically, the alarm allocation method of the present application avoids complex calculations during alarm allocation, quickly allocates alarm messages to each online duty personnel, and accelerates the flow of alarm messages; the alarm allocation method is efficient, fair, and fully automated, ensuring the fairness of online duty personnel in handling alarms and avoiding the problem of who handles the alarm who discovers it; the alarm allocation method is dynamically adjusted, the parameters are configurable, and it has strong applicability; the alarm allocation is traceable, avoiding accidents and the problem of shirking responsibility.

[0050] According to some other exemplary embodiments of the present application, determining whether the above alarm information needs to be filtered includes: using a sliding window to determine that the sum of the number of first target alarm information and the number of the above alarm information within a threshold time length is the target number, the above first target alarm information represents the above historical alarm information whose alarm type is the same as the above alarm type of the above alarm information and the alarm device is the same as the above alarm device of the above alarm information, and the above alarm device represents the device that issues the above alarm information or the above historical alarm information; determining whether the above target number is greater than the threshold number; if the above target number is greater than the above threshold number, determining that the above alarm information needs to be filtered; if the above target number is not greater than the above threshold number, determining that the above alarm information does not need to be filtered. In this embodiment, by comparing the number of alarm information issued by the same type and device within a specific time period, possible false alarms or repeated alarms can be identified, thereby reducing unnecessary alarm processing, improving the efficiency of the alarm system, and enabling the on-duty personnel to focus more on processing truly important alarms, and the sliding window technology allows the system to dynamically adjust the filtering strategy based on real-time data instead of statically relying on fixed rules.

[0051] In actual application, technicians in this field can set the above threshold duration and the above threshold number based on empirical values, or obtain them through multiple experiments. This application does not impose any specific restrictions on this.

[0052] It should be noted that, at present, the alarm front-end equipment will continue to send alarm information after detecting an alarm situation, and the security systems of various banks do not have an effective method to filter alarm messages, which often leads to some real alarm situations or alarms of other equipment being drowned out by the above alarm situations. In addition, in alarms / events, equipment false alarms and false positive events occur frequently, and effective response strategies are needed to reasonably deal with various alarms / events. Most domestic banks do not have an effective alarm filtering method. Taking a large commercial bank as an example, its filtering method for alarm information mainly relies on the alarm zone bypass and reset functions of the equipment, which requires the operator to manually operate on the equipment, and it is very likely to miss the real alarm situation. In short, at present, the alarm front-end equipment will continue to send alarm information after detecting an alarm situation, and the security systems of various banks do not have an effective method to filter alarm messages. The on-duty personnel are tired of dealing with these large numbers of repeated messages, which often leads to some real alarm situations or alarms of other equipment being ignored due to the above repeated alarms.

[0053] In some other optional schemes of the present application, the above method further includes: in the case where the above alarm information needs to be filtered, filtering the above alarm information, and filtering out the second target alarm information received within the first preset time period, the second target alarm information representing future alarm information of the same alarm type as the above alarm type of the above alarm information and the same alarm device as the above alarm device of the above alarm information, and the above alarm device representing the device that sends the above alarm information or the above future alarm information. In this embodiment, by filtering out the second target alarm information of the same type and the same alarm device received within the first preset time period, redundant alarms in the system can be further reduced, and online on-duty personnel can be further prevented from being frequently disturbed by repeated or similar alarm information, thereby further improving the practicality and efficiency of the alarm system, and at the same time further improving user satisfaction and system reliability.

[0054] In actual application, technicians in this field can set the above-mentioned first preset time length based on empirical values, or obtain it through multiple experiments. This application does not impose any specific restrictions on this.

[0055] Specifically, first set the alarm automatic filtering rules: when the number of alarms (n alarms, i.e. the target number) exceeds the threshold number (m) within a certain period of time (a time, i.e. the threshold duration), filter the alarm events of the same type reported by the device within the next period of time (b time, i.e. the first preset duration). For example, if a is set to one minute, b is set to 30 minutes, and m is set to 5, it means: when an alarm occurs 5 times within one minute, it is normally distributed, and 6 alarms are sent in one minute to meet the filtering conditions, and the subsequent alarms will be filtered within the next 30 minutes. The core idea of ​​this filtering method is the sliding window, such as Figure 4 As shown, A n To A n+m These are the nth to n+mth alarms of the same type and device. The dotted box represents a sliding window of size m, head represents the head pointer of the sliding window, and tail represents the tail pointer of the sliding window. Determine whether the alarm reaches the threshold: when each alarm is received, you only need to determine whether the number of alarms in the window and the alarm occurrence time indicated by the tail pointer are within one minute.

[0056] In summary, the alarm filtering method is: input: alarm information (including alarm occurrence time, device number, alarm type number, etc.), threshold duration a, threshold number m, alarm filtering duration b (i.e., the first preset duration), output: Y for filtering, N for not filtering: a), receive alarm information, and determine whether there is a device number + a filtering flag of the alarm type in the redis cache. If so, output Y, otherwise execute b); b), determine whether a sliding window has been established for this type of alarm of the device. If not, create a new window of size m, with the head pointer pointing to the alarm, and execute step c). If a sliding window has been established, output N; c), determine whether the number of alarms in the window is greater than m, and whether the alarm occurrence time pointed to by the tail pointer is within time a. If so, execute step d), otherwise the sliding window moves forward 1 and outputs N; d), store the device number + the filtering flag of the alarm type in redis and set the expiration time b, delete the sliding window, and output Y.

[0057] Specifically, the alarm filtering method of the present application solves the problem of the sensor continuously uploading alarm information after triggering the alarm, and solves the problem of equipment failure continuously triggering alarms; the alarm filtering method is fast and effective, the system automatically handles it, and records the filtering log, so that the filtered alarms can be traced.

[0058] In some other optional schemes of the present application, after the above-mentioned alarm information is assigned to the above-mentioned target on-duty personnel, the above-mentioned method also includes: determining whether the above-mentioned alarm information has been handled by the above-mentioned target on-duty personnel within the second preset time period; if the above-mentioned alarm information has not been handled by the above-mentioned target on-duty personnel within the above-mentioned second preset time period, reporting the above-mentioned alarm information to the superior monitoring center. In this embodiment, by checking whether the target on-duty personnel have handled the alarm information within the preset time, it can be ensured that the alarm information is responded to in a timely manner. If the alarm information is not processed within the specified time, the system will automatically report it to the superior monitoring center, thereby avoiding the potential risks caused by negligence or delayed response of the on-duty personnel, which helps to further improve the safety and reliability of the entire alarm system.

[0059] It should be noted that this application mainly relies on bank security equipment (alarm host, various alarm detectors, monitoring host, access control host, docking host). The alarm handling system mainly includes: alarm channel (combining the equipment and alarm type to virtualize the alarm type), device access sub-service (responsible for accessing equipment and receiving alarm information), alarm service (responsible for alarm filtering, allocation, timeout reporting and other alarm flows), monitoring center client (page for alarm receivers to receive and process alarms).

[0060] Specifically, Figure 5As shown, the alarm handling process is as follows: a) the device is connected to the system according to the access standard; b) the device is connected to the sub-service system and receives the alarm from the device, and sends the alarm information to the alarm service after parsing; c) the alarm service receives the alarm information, executes the alarm filtering method to filter the alarm, if the alarm is filtered, execute step d), if it is not filtered, execute step e); d) record the alarm filtering log and end; e) the alarm service executes the alarm distribution method to distribute the alarm information to an online duty person, and the online duty person's client automatically pops up the alarm handling page, the monitoring center personnel view the joint debugging information on the page and handle it, and the alarm service records the handling results; f) the alarm service starts real-time monitoring to monitor whether the alarm information is handled in time by the online duty personnel. If it is not handled within the time limit, the alarm information is automatically reported to the superior monitoring center.

[0061] Specifically, the alarm handling method of the present application mainly includes: alarm message reception, alarm distribution method, alarm filtering method and timeout reporting. Among them, the alarm filtering method can effectively filter repeated alarm messages and equipment false alarms, ensuring that truly effective messages can be discovered by on-duty personnel; the alarm distribution method can quickly and fairly distribute alarm messages to online on-duty personnel, ensuring that alarm messages are quickly circulated, and that distribution records can be checked, eliminating the problem of no one handling alarms and difficulty in accountability, and has good scalability, and can consider factors such as alarm priority, alarm type, and alarm handling time, so as to balance the busy and idle rates of on-duty personnel and improve work enthusiasm.

[0062] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the alarm handling method of the present application will be described in detail below in conjunction with specific embodiments.

[0063] This embodiment relates to a specific alarm handling method, including the following steps:

[0064] Step S1: receiving alarm information;

[0065] Step S2: Determine whether the alarm information needs to be filtered;

[0066] Step S3: When the alarm information does not need to be filtered, the Euclidean distance corresponding to each online duty officer is determined according to the busyness, fatigue and alarm handling timeliness of each online duty officer. The busyness represents the number of unhandled historical alarm messages in the hands of online staff, the fatigue represents the online time of online staff, and the alarm handling timeliness represents the timeliness of online staff handling historical alarm messages, where |X| represents the Euclidean distance, x represents the busyness, y represents the fatigue, and alarm handling represents the timeliness of alarm handling;

[0067] Step S4: determining the online on-duty personnel corresponding to the smallest Euclidean distance among the Euclidean distances as the target on-duty personnel;

[0068] Step S5: Distribute the alarm information to the target on-duty personnel;

[0069] Step S6: Determine whether the alarm information has been handled by the target on-duty personnel within the second preset time period;

[0070] Step S7: If the alarm information is not handled by the target on-duty personnel within the second preset time period, the alarm information is reported to the superior monitoring center.

[0071] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0072] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the alarm handling method.

[0073] Specifically, the alarm handling methods include:

[0074] Step S201, receiving alarm information;

[0075] Step S202, determining whether the alarm information needs to be filtered;

[0076] Step S203, when the alarm information does not need to be filtered, the Euclidean distance corresponding to each online attendant is determined according to the busyness, fatigue and alarm handling timeliness corresponding to each online attendant, wherein the busyness represents the number of unhandled historical alarm information in the hands of the online attendant, the fatigue represents the online time of the online attendant, and the alarm handling timeliness represents the timeliness of the online attendant handling the historical alarm information;

[0077] Step S204, determining a target on-duty person according to each of the above-mentioned Euclidean distances, wherein the above-mentioned target on-duty person is one of the above-mentioned multiple online on-duty persons;

[0078] Step S205: distribute the alarm information to the target on-duty personnel to handle the alarm information.

[0079] Optionally, determining a target on-duty personnel according to each of the above Euclidean distances includes: determining the online on-duty personnel corresponding to the smallest Euclidean distance among the above Euclidean distances as the target on-duty personnel.

[0080] Optionally, before determining the Euclidean distance corresponding to each of the online on-duty personnel according to the busyness, fatigue and alarm handling timeliness corresponding to each of the online on-duty personnel, the method further includes: determining the busyness as Among them, a n Indicates the number of level n in the above historical alarm information that has not been handled by the online on-duty personnel, α n Represents the preset first weight, n represents the level of the above historical alarm information, and x represents the above busyness; the above fatigue degree is determined as y=γb, wherein γ represents the preset second weight, b represents the number of consecutive online hours of the above online duty personnel, and y represents the above fatigue; the timeliness of the above alarm handling is determined as z=ζ(deal / total), wherein ζ represents the preset third weight, total represents the total number of the above historical alarm information that has been handled by the above online duty personnel, deal represents the number of the above historical alarm information that has been handled by the above online duty personnel and handled in time, and alarm handling represents the timeliness of the above alarm handling.

[0081] Optionally, according to the busyness, fatigue and alarm handling timeliness of each online on-duty personnel, determining the Euclidean distance corresponding to each online on-duty personnel includes: determining the Euclidean distance as Among them, |X| represents the Euclidean distance, x represents the busyness, y represents the fatigue, and alarm handling represents the timeliness of the alarm handling.

[0082] Optionally, determining whether the above-mentioned alarm information needs to be filtered includes: using a sliding window to determine that the sum of the number of first target alarm information and the number of the above-mentioned alarm information within a threshold time length is the target number, the above-mentioned first target alarm information represents the above-mentioned historical alarm information whose alarm type is the same as the above-mentioned alarm type of the above-mentioned alarm information and the alarm device is the same as the above-mentioned alarm device of the above-mentioned alarm information, and the above-mentioned alarm device represents the device that issues the above-mentioned alarm information or the above-mentioned historical alarm information; determining whether the above-mentioned target number is greater than the threshold number; in case the above-mentioned target number is greater than the above-mentioned threshold number, determining that the above-mentioned alarm information needs to be filtered; in case the above-mentioned target number is not greater than the above-mentioned threshold number, determining that the above-mentioned alarm information does not need to be filtered.

[0083] Optionally, the above method also includes: when the above alarm information needs to be filtered, filtering the above alarm information, and filtering out the second target alarm information received within the first preset time period, the above second target alarm information represents future alarm information whose alarm type is the same as the above alarm type of the above alarm information and the alarm device is the same as the above alarm device of the above alarm information, and the above alarm device represents the device that issues the above alarm information or the above future alarm information.

[0084] Optionally, after assigning the above-mentioned alarm information to the above-mentioned target on-duty personnel, the above-mentioned method also includes: determining whether the above-mentioned alarm information has been handled by the above-mentioned target on-duty personnel within a second preset time period; if the above-mentioned alarm information has not been handled by the above-mentioned target on-duty personnel within the above-mentioned second preset time period, reporting the above-mentioned alarm information to the superior monitoring center.

[0085] The present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement at least the following method steps: step S201, receiving alarm information; step S202, determining whether the alarm information needs to be filtered; step S203, when the alarm information does not need to be filtered, determining the Euclidean distance corresponding to each of the online on-duty personnel according to the busyness, fatigue and alarm handling timeliness corresponding to each of the online on-duty personnel, wherein the busyness represents the number of unhandled historical alarm information in the hands of the online on-duty personnel, the fatigue represents the online time of the online on-duty personnel, and the alarm handling timeliness represents the timeliness of the online on-duty personnel handling the historical alarm information; step S204, determining the target on-duty personnel according to each of the above Euclidean distances, wherein the target on-duty personnel is one of the multiple online on-duty personnel; step S205, allocating the alarm information to the target on-duty personnel to handle the alarm information.

[0086] Optionally, determining a target on-duty personnel according to each of the above-mentioned Euclidean distances includes: determining the online on-duty personnel corresponding to the smallest Euclidean distance among the above-mentioned Euclidean distances as the target on-duty personnel.

[0087] Optionally, before determining the Euclidean distance corresponding to each of the online on-duty personnel according to the busyness, fatigue and alarm handling timeliness corresponding to each of the online on-duty personnel, the method further includes: determining the busyness as Among them, a n Indicates the number of level n in the above historical alarm information that has not been handled by the online on-duty personnel, α n Represents the preset first weight, n represents the level of the above historical alarm information, and x represents the above busyness; the above fatigue degree is determined as y=γb, wherein γ represents the preset second weight, b represents the number of consecutive online hours of the above online duty personnel, and y represents the above fatigue; the timeliness of the above alarm handling is determined as z=ζ(deal / total), wherein ζ represents the preset third weight, total represents the total number of the above historical alarm information that has been handled by the above online duty personnel, deal represents the number of the above historical alarm information that has been handled by the above online duty personnel and handled in time, and alarm handling represents the timeliness of the above alarm handling.

[0088] Optionally, according to the busyness, fatigue and alarm handling timeliness of each online on-duty personnel, determining the Euclidean distance corresponding to each online on-duty personnel includes: determining the Euclidean distance as Among them, |X| represents the Euclidean distance, x represents the busyness, y represents the fatigue, and alarm handling represents the timeliness of the alarm handling.

[0089] Optionally, determining whether the above-mentioned alarm information needs to be filtered includes: using a sliding window to determine that the sum of the number of first target alarm information and the number of the above-mentioned alarm information within a threshold time length is the target number, the above-mentioned first target alarm information represents the above-mentioned historical alarm information whose alarm type is the same as the above-mentioned alarm type of the above-mentioned alarm information and the alarm device is the same as the above-mentioned alarm device of the above-mentioned alarm information, and the above-mentioned alarm device represents the device that issues the above-mentioned alarm information or the above-mentioned historical alarm information; determining whether the above-mentioned target number is greater than the threshold number; in case the above-mentioned target number is greater than the above-mentioned threshold number, determining that the above-mentioned alarm information needs to be filtered; in case the above-mentioned target number is not greater than the above-mentioned threshold number, determining that the above-mentioned alarm information does not need to be filtered.

[0090] Optionally, the above method also includes: when the above alarm information needs to be filtered, filtering the above alarm information, and filtering out the second target alarm information received within the first preset time period, the above second target alarm information represents future alarm information whose alarm type is the same as the above alarm type of the above alarm information and the alarm device is the same as the above alarm device of the above alarm information, and the above alarm device represents the device that issues the above alarm information or the above future alarm information.

[0091] Optionally, after assigning the above-mentioned alarm information to the above-mentioned target on-duty personnel, the above-mentioned method also includes: determining whether the above-mentioned alarm information has been handled by the above-mentioned target on-duty personnel within a second preset time period; if the above-mentioned alarm information has not been handled by the above-mentioned target on-duty personnel within the above-mentioned second preset time period, reporting the above-mentioned alarm information to the superior monitoring center.

[0092] An embodiment of the present application also provides an electronic device, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include means for executing any one of the above-mentioned alarm handling methods.

[0093] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0094] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0095] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0098] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0099] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0100] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0101] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0102] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0103] In the alarm handling method of the present application, the alarm information is first received, and then it is determined whether the alarm information needs to be filtered. When the alarm information does not need to be filtered, the Euclidean distance corresponding to each online on-duty personnel is determined according to the busyness, fatigue and alarm handling timeliness of each online on-duty personnel, and then the target on-duty personnel is determined according to each Euclidean distance, and finally the alarm information is allocated to the target on-duty personnel to handle the alarm information. Compared with the problem that there is no reasonable alarm allocation rule in the prior art, which leads to frequent timeout of alarm handling or no one handling the alarm, the present application calculates the busyness, fatigue and alarm handling timeliness of the online on-duty personnel, and determines the Euclidean distance based on these parameters, so that the alarm information can be more reasonably allocated to the most suitable on-duty personnel, ensuring that the workload of each on-duty personnel is relatively balanced, ensuring the fairness of the on-duty personnel in handling the alarm, and can adapt to the changes in the status of the on-duty personnel, adjust the allocation of alarm information in real time, realize the efficient and reasonable allocation of alarm information, and improve the efficiency and quality of alarm processing; in addition, by determining whether the alarm information needs to be filtered, unnecessary processing procedures can be reduced and the efficiency of alarm handling can be improved.

[0104] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An alarm handling method, characterized in that: include: Receive alarm information; Determining whether the alarm information needs to be filtered; In the case where the alarm information does not need to be filtered, the Euclidean distance corresponding to each online attendant is determined according to the busyness, fatigue and alarm handling timeliness corresponding to each online attendant, wherein the busyness represents the number of unhandled historical alarm information in the hands of the online attendant, the fatigue represents the online time of the online attendant, and the alarm handling timeliness represents the timeliness of the online attendant handling the historical alarm information; Determine a target on-duty person according to each of the Euclidean distances, wherein the target on-duty person is one of the multiple online on-duty persons; The alarm information is distributed to the target on-duty personnel to handle the alarm information.

2. The alarm handling method according to claim 1, characterized in that: According to each of the Euclidean distances, the target on-duty personnel are determined, including: The online guard corresponding to the smallest Euclidean distance among the Euclidean distances is determined as the target guard.

3. The alarm handling method according to claim 2, characterized in that: Before determining the Euclidean distance corresponding to each online attendant according to the busyness, fatigue and alarm handling timeliness corresponding to each online attendant, the method further includes: Determine the busyness as Among them, a n Indicates the number of historical alarm messages of level n that have not been handled by the online on-duty personnel, α n represents a preset first weight, n represents the level of the historical alarm information, and x represents the busyness; Determine the fatigue degree as y=γb, wherein γ represents a preset second weight, b represents the number of hours that the online attendant is continuously online, and y represents the fatigue degree; The timeliness of the alarm handling is determined as z=ζ(deal / total), wherein ζ represents the preset third weight, total represents the total number of the historical alarm messages that have been handled by the online duty personnel, deal represents the number of the historical alarm messages that have been handled and handled in time by the online duty personnel, and alarm handling represents the timeliness of the alarm handling.

4. The alarm handling method according to claim 1, characterized in that: According to the busyness, fatigue and alarm handling timeliness of each online duty personnel, the Euclidean distance corresponding to each online duty personnel is determined, including: The Euclidean distance is determined as Among them, |X| represents the Euclidean distance, x represents the busyness, y represents the fatigue, and alarm handling represents the timeliness of the alarm handling.

5. The alarm handling method according to claim 1, characterized in that: Determining whether the alarm information needs to be filtered includes: Using a sliding window, determining the sum of the number of first target alarm information and the number of the alarm information within a threshold time length as the target number, the first target alarm information representing the historical alarm information having the same alarm type as the alarm type of the alarm information and the same alarm device as the alarm device of the alarm information, and the alarm device representing the device that issued the alarm information or the historical alarm information; Determine whether the target number is greater than a threshold number; if the target number is greater than the threshold number, determine that the alarm information needs to be filtered; When the target number is not greater than the threshold number, it is determined that the alarm information does not need to be filtered.

6. The alarm handling method according to claim 1, characterized in that: The method further comprises: In the case where the alarm information needs to be filtered, the alarm information will be filtered, and the second target alarm information received within the first preset time period will be filtered out, the second target alarm information represents future alarm information whose alarm type is the same as the alarm type of the alarm information and whose alarm device is the same as the alarm device of the alarm information, and the alarm device represents the device that issues the alarm information or the future alarm information.

7. The alarm handling method according to claim 1, characterized in that: After allocating the alarm information to the target on-duty personnel, the method further includes: Determining whether the alarm information has been handled by the target on-duty personnel within a second preset time period; When the alarm information is not handled by the target on-duty personnel within the second preset time period, the alarm information is reported to a superior monitoring center.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the alarm handling method according to any one of claims 1 to 7.

9. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the alarm handling method described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing the alarm handling method described in any one of claims 1 to 7.

Images