Alarm identification method, device, equipment, medium and program product

Abstract

The invention provides an alarm identification method which can be applied to the technical field of artificial intelligence. The alarm recognition method comprises the steps that alarm information is obtained and preprocessed, a numeralized word vector text is obtained, and the word vector text comprises environment information and alarm description; inputting the word vector text into a pre-trained alarm classification model, and executing the following operations: generating a context vector according to a front-back semantic relationship of the word vector text, the context vector representing global semantic information of the alarm information; fusing features corresponding to the context vector, the environment information and the alarm description, and extracting semantic features capable of representing the emergency degree of the alarm information and position information corresponding to the semantic features from the fused features; and predicting the category of the alarm information according to the semantic features and the position information. The invention further provides an alarm recognition device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, and more specifically to an alarm identification method, device, equipment, medium and program product. Background Art

[0002] Big data technology is developing rapidly, and the massive amount of information presented to users is mostly in the form of semi-structured or pure raw text. How to use natural language processing related technologies to solve real-life problems is an urgent need of contemporary computer research technology.

[0003] The existing monitoring alarm level classification is mostly done manually. According to the alarm type, such as performance alarm, capacity alarm, security alarm, etc., the monitoring alarm is divided into multiple levels, and the urgency of handling the alarm is determined by the level. Due to the different application scenarios of each system environment, there may be large differences in performance tolerance. This method cannot make a preparation judgment based on a specific environment. During periods of frequent alarms, there is a risk of falsely prompting operation and maintenance personnel. It can be seen that the alarm identification method in the existing technology is difficult to effectively classify and identify alarm information, and the processing efficiency is low. Summary of the invention

[0004] In view of the above problems, the present disclosure provides an alarm identification method, apparatus, device, medium and program product that can effectively classify and identify alarm information.

[0005] According to the first aspect of the present disclosure, there is provided an alarm identification method, including: obtaining alarm information, and preprocessing the alarm information to obtain a digitized word vector text, wherein the word vector text includes environmental information and an alarm description; inputting the word vector text into a pre-trained alarm classification model, and performing the following operations: generating a context vector according to the contextual semantic relationship between the word vector text and the context vector, wherein the context vector represents the global semantic information of the alarm information; fusing features corresponding to the context vector, the environmental information and the alarm description, and extracting semantic features that can represent the urgency of the alarm information, and location information corresponding to the semantic features from the fused features; and predicting the category of the alarm information according to the semantic features and the location information.

[0006] According to an embodiment of the present disclosure, the alarm information is preprocessed to obtain a numeralized word vector text, including: performing word segmentation on the alarm information to obtain a word sequence corresponding to the alarm information; performing one-hot encoding on the word sequence to obtain a vector matrix corresponding to the word sequence; and concatenating the vector matrix to generate a word vector text.

[0007] According to an embodiment of the present disclosure, the structure of the alarm classification model includes: a context representation layer, wherein the context representation layer is configured as a bidirectional long short-term memory network, and is used to generate a context vector based on the before and after semantic relationship of a word vector text; a classification layer, wherein the classification layer is configured as a convolutional neural network, and is used to fuse the context vector, environmental information, and features corresponding to the alarm description, and extract semantic features that can characterize the urgency of the alarm information, as well as location information corresponding to the semantic features from the fused features; and predict the category of the alarm information based on the semantic features and the location information.

[0008] According to an embodiment of the present disclosure, a bidirectional long short-term memory network includes a forward long short-term memory network and a backward long short-term memory network, wherein generating a context vector according to the previous and next semantic relationships of a word vector text includes: extracting the previous semantic relationship of the word vector text by using the forward long short-term memory network; extracting the following semantic relationship of the word vector text by using the backward long short-term memory network; and concatenating the semantic encoding vectors corresponding to the previous semantic relationship and the following semantic relationship to obtain a context vector.

[0009] According to an embodiment of the present disclosure, the classification layer includes a fully connected layer, wherein semantic features capable of characterizing the urgency of the alarm information are extracted from the fused features, and the position information corresponding to the semantic features includes: using the channel attention mechanism of the fully connected layer to identify the semantic features capable of characterizing the urgency of the alarm information; and using the spatial attention mechanism of the fully connected layer to determine the position information corresponding to the semantic features.

[0010] According to an embodiment of the present disclosure, the classification layer also includes an activation layer, wherein, based on the semantic features and the location information, predicting the category of the alarm information includes: using the activation layer to map the semantic features and the location information to the probability distribution space; based on the probability distribution space, according to the semantic features and the location information, predicting the probability that the alarm information belongs to a preset category; and determining the classification result of the alarm information according to the size of the probability.

[0011] According to an embodiment of the present disclosure, the method further includes: grading the classification results to obtain an alarm level, wherein the alarm level is used to characterize the priority of alarm processing; and according to the alarm level, starting a response mechanism corresponding to the alarm level.

[0012] According to an embodiment of the present disclosure, the method further includes: presenting the processing results of the response mechanism to management personnel through a visual interface; and performing statistical analysis on the processing results to obtain historical alarm trends.

[0013] The second aspect of the present disclosure provides an alarm identification device, including: an acquisition module, used to acquire alarm information and pre-process the alarm information to obtain a digitized word vector text, wherein the word vector text includes environmental information and an alarm description; an execution module, used to input the word vector text into a pre-trained alarm classification model; a generation module, used to generate a context vector according to the contextual semantic relationship between the word vector text, wherein the context vector represents the global semantic information of the alarm information; a fusion module, used to fuse the features corresponding to the context vector, the environmental information and the alarm description, and extract semantic features that can represent the urgency of the alarm information, and the position information corresponding to the semantic features from the fused features; a prediction module, used to predict the category of the alarm information according to the semantic features and the position information.

[0014] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0015] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0016] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 The application scenario diagram of the alarm identification method according to the embodiment of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart of an alarm identification method according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart of a method for preprocessing warning information to obtain a digitized word vector text according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 4 The structure diagram of the alarm classification model according to the embodiment of the present disclosure is schematically shown;

[0022] Figure 5 The structure block diagram of the alarm identification device according to the embodiment of the present disclosure is schematically shown;

[0023] Figure 6 A block diagram of an electronic device suitable for implementing the alarm identification method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] It should be noted that the alarm identification method and device disclosed herein can be used for alarm identification applications in the financial technology field, and can also be used for alarm identification applications in any field other than the financial technology field. The application field of the alarm identification method and device disclosed herein is not limited.

[0029] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0031] An embodiment of the present disclosure provides an alarm identification method, including: obtaining alarm information, and preprocessing the alarm information to obtain a digitized word vector text, wherein the word vector text includes environmental information and an alarm description; inputting the word vector text into a pre-trained alarm classification model, and performing the following operations: generating a context vector based on the contextual semantic relationship between the word vector text, wherein the context vector represents the global semantic information of the alarm information; fusing features corresponding to the context vector, the environmental information, and the alarm description, and extracting semantic features that can represent the urgency of the alarm information, as well as the location information corresponding to the semantic features, from the fused features; and predicting the category of the alarm information based on the semantic features and the location information.

[0032] The alarm identification method provided by the embodiment of the present disclosure uses the environmental information and alarm description in the alarm information as the main input features, and uses the deep learning model to automatically extract the semantic features that can characterize the urgency of the alarm information (such as keywords such as "serious", "abnormal", "system crash") and its location information (such as the beginning of the text, the middle field or the end, etc.), and finally predicts the alarm category in combination with the semantic features and location information. Since the key semantic features and location information in the alarm information play a decisive role in the classification of alarm categories, the automatic extraction of semantic features and location information through the deep learning model can, on the one hand, more accurately capture the subtle differences in the alarm information and reduce misjudgments and missed judgments. On the other hand, compared with the traditional methods based on manual rules or keyword matching, it can greatly improve the operation and maintenance efficiency.

[0033] Figure 1 The application scenario diagram of the alarm identification method according to an embodiment of the present disclosure is schematically shown.

[0034] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, and a third terminal device 103. A network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and a server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0035] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0037] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0038] It should be noted that the ATM target route determination method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the ATM target route determination device provided in the embodiment of the present disclosure can generally be set in the server 105. The ATM target route determination method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the ATM target route determination device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0039] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0040] The following will be based on Figure 1 The scene described by Figure 2~Figure 4 The alarm identification method of the disclosed embodiment is described in detail.

[0041] Figure 2 The flowchart of the alarm identification method according to the embodiment of the present disclosure is schematically shown.

[0042] like Figure 2 As shown, the alarm identification method of this embodiment includes operations S210 to S250, and the ATM target route determination method can be executed by a server.

[0043] In operation S210, alarm information is obtained and preprocessed to obtain digitized word vector text, wherein the word vector text includes environmental information and alarm description.

[0044] In operation S220, the word vector text is input into a pre-trained alarm classification model, and the following operations S230 to S250 are performed.

[0045] In operation S230, a context vector is generated according to the semantic relationship between the word vector text and the context vector, wherein the context vector represents the global semantic information of the warning information.

[0046] In operation S240, the context vector, the environmental information, and features corresponding to the alarm description are fused, and semantic features that can characterize the urgency of the alarm information and location information corresponding to the semantic features are extracted from the fused features.

[0047] In operation S250 , the category of the warning information is predicted based on the semantic feature and the location information.

[0048] Alarm information usually refers to key data or notifications used to monitor and maintain system stability, detect and handle abnormal situations in a timely manner, and is intended to reflect system operating status, abnormal situations or potential risks. Alarm information can usually come from the following types of systems or tools:

[0049] (1) Hardware monitoring: such as servers, storage devices or network devices, providing hardware status (such as CPU, memory, disk, etc.).

[0050] For example: insufficient disk space (90% used), memory usage exceeded.

[0051] (2) Operating system: provides system-level resource status and error information.

[0052] For example: system thread blocking, I / O operation failure.

[0053] (3) Log analysis tools: abnormal events extracted from system logs.

[0054] For example: Critical error information appears in the log.

[0055] (4) Security systems: such as intrusion detection, firewalls, etc., providing security alerts.

[0056] For example: unusual login attempts, denial of service attacks.

[0057] In an embodiment of the present disclosure, alarm information is firstly acquired from a monitoring environment, for example, by utilizing an existing program to acquire alarm information from the monitoring environment in real time.

[0058] Since the environmental information in the alarm information is tabular information and the alarm details (alarm description) are unstructured text, they need to be preprocessed first to convert them into numerical word vector text in preparation for subsequent model processing.

[0059] The word vector text obtained after preprocessing is then input into the pre-trained alarm classification model for relationship extraction.

[0060] Relation extraction is an important part of building a knowledge graph. It aims to identify the semantic relationship between entities, mainly extracting the semantic relationship between entities from unstructured and semi-structured sentences. The relationship category can be predefined type relationship and open domain relationship. Open domain relationship extraction means that the extracted relationship is not defined in advance, and the system automatically identifies and extracts the relationship from the file. Using the open domain relationship extraction model for semantic extraction of alarm detail information description can provide more valuable feature information for alarm classification.

[0061] Since the alarm details are mostly simple sentences, that is, they only contain a subject-predicate structure, and each sentence component is an independent sentence or clause consisting of only words or phrases, in the semantic extraction part, the model is expected to extract the entity and its relationship features in the sentence.

[0062] For example, in the alarm description "xxx intelligent operation and maintenance inspection found that the server memory usage is abnormal and the current value is 90%", (server, memory usage, 90%) is extracted.

[0063] In the embodiments of the present disclosure, the model processing process can be divided into two parts as a whole, namely, the semantic extraction part and the classification part.

[0064] For the semantic extraction part, a context vector is generated based on the semantic relationship between the word vector text and the previous and next words. The context vector condenses the global semantics and key information of the warning information.

[0065] For the classification part, the context vector obtained by the semantic extraction part is fused with the environmental information and alarm description in the alarm information to supplement the key information that is not fully captured by the semantic extraction part. Then, the key information is extracted from the fused features, that is, the semantic features that can characterize the urgency of the alarm information and the location information corresponding to the semantic features are extracted.

[0066] Extract key information from the fused features, such as:

[0067] Extract key words such as "serious", "abnormal", and "system crash" from high-priority alarm information.

[0068] Extract descriptive information such as "performance degradation" and "insufficient resources" from the medium priority alarm information.

[0069] Extract suggestive words such as "reminder" and "suggestion" from low-priority alarm information.

[0070] Position information refers to the specific location of these key information in the alarm text or its semantically related location. Position information can help the model understand the role of these key contents in the context. For example, information appearing at the beginning of the text may be more important (such as the title), and information appearing in specific fields (such as the "alarm description" field) may be more meaningful, while information appearing at the end of the text may have relatively low reference significance.

[0071] Finally, based on the extracted key information and location information, the probability that the alarm information belongs to category i is predicted.

[0072] For example, if the probability that the alarm information belongs to the high priority is 0.85, the probability that it belongs to the medium priority is 0.10, and the probability that it belongs to the low priority is 0.05, it means that the alarm information belongs to the high priority category.

[0073] According to the embodiments of the present disclosure, by taking the environmental information and alarm description in the alarm information as the main input features, the deep learning model is used to automatically extract the semantic features that can characterize the urgency of the alarm information (such as keywords such as "serious", "abnormal", "system crash") and its location information (such as the beginning of the text, the middle field or the end, etc.), and finally the alarm category is predicted in combination with the semantic features and location information. Since the key semantic features and location information in the alarm information play a decisive role in the classification of alarm categories, the automatic extraction of semantic features and location information through the deep learning model can, on the one hand, more accurately capture the subtle differences in the alarm information and reduce misjudgments and missed judgments. On the other hand, compared with the traditional methods based on manual rules or keyword matching, it can greatly improve the operation and maintenance efficiency.

[0074] Figure 3 The flowchart schematically shows a method for preprocessing alarm information to obtain digitized word vector text according to an embodiment of the present disclosure.

[0075] like Figure 3 As shown, the method of preprocessing the alarm information to obtain the digitized word vector text in this embodiment includes operation S310 to operation S330.

[0076] In operation S310, word segmentation is performed on the warning information to obtain a word sequence corresponding to the warning information.

[0077] In operation S320, one-hot encoding is performed on the word sequence to obtain a vector matrix corresponding to the word sequence.

[0078] In operation S330, the vector matrices are concatenated to generate word vector text.

[0079] In the embodiments of the present disclosure, the original alarm information is cleaned in advance to remove noise and irrelevant content, such as removing special characters and redundant information. Specifically, meaningless content such as labels, line breaks, tabs, or extra spaces may be removed.

[0080] After the cleaning is completed, the warning information is firstly segmented, that is, the sentence is decomposed into words or phrases to obtain the word sequence corresponding to the warning information.

[0081] For example, the phrase “system performance has degraded, please check the load” is segmented into “system”, “performance”, “degraded”, “please”, “check”, and “load”.

[0082] Then use the embedding model to convert the segmented text into a high-dimensional vector. For example, perform One-Hot Encoding on the word sequence to obtain a vector matrix corresponding to the word sequence.

[0083] Finally, the obtained vector matrices are concatenated to form numerical word vector text.

[0084] According to the embodiments of the present disclosure, since the alarm information obtained from the monitoring environment is usually tabular data or unstructured text, it is difficult for the model to process directly. Therefore, through preprocessing such as word segmentation and encoding, it can be converted into a numerical vector representation that can be used by the model to provide high-quality input, so that the model can more accurately analyze the alarm information and perform classification predictions.

[0085] Figure 4 The structure diagram of the alarm classification model according to the embodiment of the present disclosure is schematically shown.

[0086] like Figure 4 As shown, the structure of the alarm classification model of this embodiment includes: a context representation layer and a classification layer.

[0087] The context representation layer is configured as a bidirectional long short-term memory network, which is used to generate a context vector based on the semantic relationship between the previous and next word vector texts.

[0088] The classification layer is configured as a convolutional neural network, which is used to fuse the features corresponding to the context vector, environmental information, and alarm description, and extract semantic features that can characterize the urgency of the alarm information and the location information corresponding to the semantic features from the fused features; based on the semantic features and location information, the category of the alarm information is predicted.

[0089] In the embodiments of the present disclosure, the context representation layer can be regarded as an open domain relationship extraction problem, using a bidirectional long short-term memory network (Bi-LSTM) and an Attention mechanism.

[0090] Bidirectional long short-term memory network is a special recurrent neural network (RNN) that can capture the previous and next dependencies in sequence data. Bi-LSTM processes the sequence by combining a forward LSTM and a reverse LSTM, thus taking into account the previous and next context information of each element in the sequence.

[0091] The Attention mechanism is a technology that allows the model to focus on important information and fully learn and absorb it. Its core function is to filter out the most important part for the current task from a large amount of input information.

[0092] The context representation layer focuses on the deep semantic representation of the input alarm information (including environmental information and alarm description), and extracts high-dimensional vectors that can describe the characteristics of the alarm text.

[0093] In an embodiment of the present disclosure, the classification layer is based on the CBAM (Convolutional Block Attention Module, plug-and-play attention module) module, which connects the convolutional block attention to the CNN (convolutional neural network), and uses the output of the context representation layer and other important information in the alarm information, such as environmental information, alarm description, etc. as the input of the classification layer to extract key information and location information, and then connect to the next CNN layer to finally determine the classification result.

[0094] According to the embodiments of the present disclosure, the alarm classification model is designed as a two-layer structure (context representation layer and classification layer). The context representation layer focuses on the deep semantic representation of the input alarm information (including environmental information and alarm description), and extracts high-dimensional vectors that can describe the characteristics of the alarm text; the classification layer combines the output of the context representation layer with the directly input environmental information and alarm description to optimize specific classification tasks. This hierarchical structure makes feature extraction and classification decoupling more flexible. For example, if it needs to be expanded to a multi-classification task, only the classification layer needs to be adjusted, and the context representation layer can be reused.

[0095] In an embodiment of the present disclosure, the bidirectional long short-term memory network includes a forward long short-term memory network and a backward long short-term memory network.

[0096] Among them, using a bidirectional long short-term memory network to generate a context vector according to the previous and next semantic relationship of the word vector text includes operations S410 to S430.

[0097] Operation S410: extracting contextual semantic relations of the word vector text using a forward long short-term memory network.

[0098] Operation S420: extracting context semantic relations of the word vector text using a backward long short-term memory network.

[0099] Operation S430 is to concatenate the semantic encoding vectors corresponding to the previous semantic relationship and the following semantic relationship to obtain a context vector.

[0100] Since the bidirectional long short-term memory network is composed of a forward LSTM and a backward LSTM, in the embodiment of the present disclosure, the word vector and position vector of each word are concatenated as the input vector of the BI-LSTM model. .

[0101] For a word in a sentence , the forward LSTM is based on the previous word arrive ,Will Encoding into vector , the backward LSTM is based on the following words arrive ,Will Encoding into vector ,vector With vector Calculation process and words The final expression As shown below:

[0102]

[0103]

[0104]

[0105] in, Represents the context vector obtained by concatenating the semantic encoding vectors corresponding to the previous semantic relationship and the following semantic relationship.

[0106] According to the embodiments of the present disclosure, the bidirectional long short-term memory network can capture the forward and backward dependencies between words in the alarm description by reading information from the text in both the forward (left to right) and backward (right to left) directions at the same time, thereby effectively enhancing the semantic representation capability of the alarm information and providing more comprehensive and accurate feature support for alarm category prediction.

[0107] In an embodiment of the present disclosure, the classification layer includes a full connection layer.

[0108] Among them, using a fully connected layer to extract semantic features that can characterize the urgency of the alarm information from the fused features, and the position information corresponding to the semantic features includes operations S440 to S450.

[0109] In operation S440, a channel attention mechanism of a fully connected layer is used to identify semantic features that can characterize the urgency of the alarm information.

[0110] In operation S450, the spatial attention mechanism of the fully connected layer is used to determine the position information corresponding to the semantic feature.

[0111] The full connection layer is configured with channel attention and spatial attention.

[0112] After the context vector is generated by the context representation layer, the context vector and other important information in the alarm information, such as environmental information and alarm description, are fused as the input vector F of the classification layer, and then the channel attention is used to output the "semantic feature" M C(F), that is, outputting key information or valuable information that can characterize the urgency of the warning information, and then using spatial attention to output the “information position” M corresponding to the semantic feature S (F), “semantic feature” M C (F) and "Information Location" M S (F) is expressed as follows:

[0113] M C (F)=sigmoid(MLP(AvgPool(F))+ MLP(MaxPool(F)))

[0114] M S (F)=sigmoid( MLP([AvgPool(F); MLP(MaxPool(F))])

[0115] Further according to the “semantic feature” M C (F) and "Information Location" M S (F) can determine the output F of the fully connected layer 2 :

[0116]

[0117] According to the embodiments of the present disclosure, a channel attention mechanism is configured for the fully connected layer to extract valuable information, which can filter redundant information and enhance key features. A spatial attention mechanism is configured to extract position information, which can locate important semantic content and understand complex sentences in context. The combination of the two realizes global and local collaborative modeling, which greatly improves the accuracy and generalization ability of alarm classification.

[0118] In an embodiment of the present disclosure, the classification layer further includes an activation layer (Softmax).

[0119] Among them, predicting the category of the warning information according to the semantic features and the location information using the activation layer includes operation S460 to operation S480.

[0120] In operation S460, the semantic features and the position information are mapped to a probability distribution space using an activation layer.

[0121] Operation S470 , based on the probability distribution space, according to the semantic features and the location information, predict the probability that the warning information belongs to a preset category.

[0122] Operation S480: determining a classification result of the alarm information according to the probability.

[0123] The activation layer (Softmax) serves as the output layer of the model, converting the network output into a probability distribution. That is, the activation layer outputs the "score" (logits) of each category. These scores represent the tendency of the alarm information to belong to each corresponding category. Specifically, Softmax amplifies larger scores through an exponential function and normalizes them to the probability space, so that each category has a clear confidence representation. Then, these scores are converted into a probability distribution with a sum of 1 based on semantic features and location information.

[0124] For alarm classification tasks, there are usually multiple possible categories (such as "hardware failure", "network anomaly", "system performance degradation", etc.). Softmax can clearly assign a probability to each category, indicating the confidence that the alarm belongs to a certain category. Finally, the classification result of the alarm information is determined based on the size of the probability distribution.

[0125] For example, if the probability that the alarm information belongs to the high priority is 0.85, the probability that it belongs to the medium priority is 0.10, and the probability that it belongs to the low priority is 0.05, it means that the alarm information belongs to the high priority category.

[0126] According to the embodiments of the present disclosure, the activation layer can clearly assign a probability to each category by converting the output of the model into a probability distribution, indicating the confidence that the alarm information belongs to a certain category, thereby greatly improving the classification accuracy.

[0127] In an embodiment of the present disclosure, the alarm identification method may further include:

[0128] The classification results are classified into levels to obtain an alarm level, wherein the alarm level is used to represent the priority of alarm processing.

[0129] According to the alarm level, a response mechanism corresponding to the alarm level is initiated.

[0130] For example, the classification results can be divided into different alarm levels (such as high, medium, low or 1, 2, 3 levels), and then for each alarm level, the response mechanism corresponding to the alarm level is activated. Specifically:

[0131] For high-level alarms:

[0132] Immediately trigger the emergency response mechanism and notify relevant persons in charge (such as operation and maintenance engineers or security teams) for priority processing, and automatically trigger the repair script (if there is a predefined repair process).

[0133] For medium-level alarms: record them in the alarm system or log platform and wait for subsequent manual or automated confirmation. Set reminders (such as regularly checking whether they have been upgraded to a high level).

[0134] For low-level alarms:

[0135] Archive as reference data for subsequent trend analysis or modeling optimization. If the frequency of occurrence is high, it can be marked as an event that needs to be observed.

[0136] According to the embodiments of the present disclosure, through the classification of alarm levels, key problems can be solved with priority and the interference of low-priority problems can be reduced. For high-priority alarms (such as system downtime, network interruption, etc.), a rapid response mechanism can be started immediately, and for low-priority alarms (such as minor performance fluctuations), they can be postponed or automated. This will help to better realize resource allocation.

[0137] In an embodiment of the present disclosure, the alarm identification method may further include:

[0138] The processing results of the response mechanism are presented to the management personnel through a visual interface, and statistical analysis is performed on the processing results to obtain historical alarm trends.

[0139] Through the visual interface, managers can quickly locate which alarms have been resolved, which are being processed, and whether there are bottlenecks in the processing process. For example, the dashboard displays "current alarm distribution", "unprocessed alarm list" and "high priority alarm processing status".

[0140] Statistical analysis of historical alarm data can identify potential problems or system anomalies and conduct trend analysis. For example, finding that "alarms for abnormal CPU usage have increased by 50% in the past 7 days" may point to a trend of increased system load or increased business volume, thereby optimizing related resources in advance.

[0141] According to the embodiments of the present disclosure, through a visual interface, managers can intuitively understand the processing progress of the response mechanism and grasp the system operation status in real time. Statistical analysis of historical alarm data can timely discover potential problems or system anomalies, thereby providing support for operation and maintenance planning.

[0142] Based on the above alarm identification method, the present disclosure also provides an alarm identification device. Figure 5 The device is described in detail.

[0143] Figure 5 The structural block diagram of the alarm identification device according to an embodiment of the present disclosure is schematically shown.

[0144] like Figure 5 As shown, the alarm identification device 500 of this embodiment includes an acquisition module 510 , an execution module 520 , a generation module 530 , a fusion module 540 and a prediction module 550 .

[0145] The acquisition module 510 is used to acquire the alarm information and pre-process the alarm information to obtain a numerical word vector text, wherein the word vector text includes environmental information and an alarm description. In one embodiment, the acquisition module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0146] The execution module 520 is used to input the word vector text into the pre-trained alarm classification model. In one embodiment, the execution module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0147] The generating module 530 is used to generate a context vector according to the semantic relationship between the word vector text, wherein the context vector represents the global semantic information of the warning information. In one embodiment, the generating module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0148] The fusion module 540 is used to fuse the context vector, the environmental information, and the features corresponding to the alarm description, and extract the semantic features that can characterize the urgency of the alarm information and the location information corresponding to the semantic features from the fused features. In one embodiment, the fusion module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0149] The prediction module 550 is used to predict the category of the warning information according to the semantic features and the location information. In one embodiment, the prediction module 550 can be used to perform the operation S250 described above, which will not be described in detail here.

[0150] According to an embodiment of the present disclosure, the acquisition module 510 includes: a word segmentation module, an encoding module and a splicing module.

[0151] The word segmentation module is used to perform word segmentation processing on the alarm information to obtain a word sequence corresponding to the alarm information.

[0152] The encoding module is used to perform one-hot encoding on the word sequence to obtain a vector matrix corresponding to the word sequence.

[0153] The splicing module is used to splice vector matrices to generate word vector text.

[0154] According to an embodiment of the present disclosure, the alarm identification device 500 further includes: a level classification module and a response module.

[0155] The level classification module is used to classify the classification results to obtain an alarm level, wherein the alarm level is used to represent the priority of the alarm being processed.

[0156] The response module is used to start a response mechanism corresponding to the alarm level according to the alarm level.

[0157] According to an embodiment of the present disclosure, the alarm identification device 500 further includes: a display module and a statistical module.

[0158] The display module is used to present the processing results of the response mechanism to managers through a visual interface.

[0159] The statistics module is used to perform statistical analysis on the processing results and obtain historical alarm trends.

[0160] According to an embodiment of the present disclosure, any multiple modules of the acquisition module 510, the execution module 520, the generation module 530, the fusion module 540 and the prediction module 550 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 510, the execution module 520, the generation module 530, the fusion module 540 and the prediction module 550 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the acquisition module 510 , the execution module 520 , the generation module 530 , the fusion module 540 and the prediction module 550 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0161] Figure 6 A block diagram of an electronic device suitable for implementing the alarm identification method according to an embodiment of the present disclosure is schematically shown.

[0162] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0163] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0164] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0165] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0166] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0167] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present disclosure.

[0168] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0169] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0170] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0171] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0172] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0173] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0174] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An alarm identification method, characterized in that: The method comprises: Acquire alarm information, and pre-process the alarm information to obtain a digitized word vector text, wherein the word vector text includes environmental information and an alarm description; Input the word vector text into the pre-trained alarm classification model and perform the following operations: Generate a context vector according to the semantic relationship between the word vector text and the previous and next words, wherein the context vector represents the global semantic information of the warning information; Fusing the context vector, the environmental information, and features corresponding to the alarm description, and extracting semantic features that can characterize the urgency of the alarm information, and location information corresponding to the semantic features from the fused features; The category of the warning information is predicted according to the semantic feature and the location information.

2. The method according to claim 1, characterized in that The preprocessing of the warning information to obtain a numerical word vector text includes: Performing word segmentation processing on the warning information to obtain a word sequence corresponding to the warning information; Performing one-hot encoding processing on the word sequence to obtain a vector matrix corresponding to the word sequence; The vector matrices are concatenated to generate word vector text.

3. The method according to claim 1, characterized in that The structure of the alarm classification model includes: A context representation layer, wherein the context representation layer is configured as a bidirectional long short-term memory network, for generating a context vector according to the semantic relationship between the word vector text and the previous and next words; A classification layer, wherein the classification layer is configured as a convolutional neural network, for fusing the context vector, the environmental information, and features corresponding to the alarm description, and extracting semantic features that can characterize the urgency of the alarm information, and location information corresponding to the semantic features from the fused features; and predicting the category of the alarm information based on the semantic features and the location information.

4. The method according to claim 3, characterized in that The bidirectional long short-term memory network includes a forward long short-term memory network and a backward long short-term memory network, wherein generating a context vector according to the semantic relationship between the word vector text and the preceding and following ones includes: Extracting the contextual semantic relationship of the word vector text using the forward long short-term memory network; Extracting the following semantic relationship of the word vector text using the backward long short-term memory network; The semantic encoding vectors corresponding to the preceding semantic relationship and the following semantic relationship are concatenated to obtain a context vector.

5. The method according to claim 3, characterized in that: The classification layer includes a fully connected layer, wherein the semantic features that can characterize the urgency of the alarm information are extracted from the fused features, and the location information corresponding to the semantic features includes: Using the channel attention mechanism of the fully connected layer to identify semantic features that can characterize the urgency of the warning information; The spatial attention mechanism of the fully connected layer is used to determine the position information corresponding to the semantic feature.

6. The method according to claim 5, characterized in that The classification layer further includes an activation layer, wherein predicting the category of the warning information according to the semantic feature and the location information includes: Mapping the semantic features and the position information to a probability distribution space using the activation layer; Based on the probability distribution space, according to the semantic features and the location information, predicting the probability that the warning information belongs to a preset category; A classification result of the warning information is determined according to the size of the probability.

7. The method according to claim 1, characterized in that The method further comprises: Classifying the classification results to obtain an alarm level, wherein the alarm level is used to represent the priority of alarm processing; According to the alarm level, a response mechanism corresponding to the alarm level is initiated.

8. The method according to claim 7, characterized in that The method further comprises: Presenting the processing results of the response mechanism to management personnel through a visual interface; Perform statistical analysis on the processing results to obtain historical alarm trends.

9. An alarm identification device, characterized in that: The device comprises: An acquisition module, used to acquire alarm information and pre-process the alarm information to obtain a numerical word vector text, wherein the word vector text includes environmental information and an alarm description; An execution module, used for inputting the word vector text into a pre-trained alarm classification model; A generating module, used to generate a context vector according to the semantic relationship between the word vector text and the context vector, wherein the context vector represents the global semantic information of the warning information; A fusion module, used to fuse the context vector, the environmental information and the features corresponding to the alarm description, and extract semantic features that can characterize the urgency of the alarm information and the location information corresponding to the semantic features from the fused features; A prediction module is used to predict the category of the warning information according to the semantic features and the location information.

10. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs; It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images