Alarm storm detection and processing method, device, equipment, medium and product

Abstract

The invention provides an alarm storm detection and processing method and device, equipment, a medium and a product, and relates to the technical field of network management, and the method comprises the steps: obtaining alarm data, and carrying out the preprocessing; performing dimension arrangement on the pre-processed alarm data through an alarm dimension arrangement device to obtain at least one alarm data set; selecting at least one threshold coefficient generator to respectively generate a threshold coefficient corresponding to each alarm data set; obtaining to-be-detected alarm data, determining an alarm threshold value according to the dimension and the timestamp of the to-be-detected alarm data and the corresponding threshold coefficient, and if the alarm number of the to-be-detected alarm data exceeds the threshold value, determining that there is an alarm storm; and converting the abnormal alarm data corresponding to the alarm storm to an abnormal queue based on the alarm data transfer device. Through intelligent detection and differentiation processing, important alarms are processed preferentially, the influence of alarm storm on system resources is effectively reduced, and the fault management efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network management, and in particular, to an alarm storm detection and processing method, device, equipment, medium and product. Background Art

[0002] With the rapid development of information technology, the scale of network systems and software applications has become increasingly large, and the complexity has also been continuously increasing. In this context, the fault management system, as a key link to ensure the stable operation of the system, is facing unprecedented challenges. Especially when the system encounters a serious fault, the outbreak of an alarm storm often leads to a large number of repeated, irrelevant or low-priority alarm messages flooding in, which not only masks the truly important alarms, but also seriously consumes system resources and prolongs the fault recovery time.

[0003] Existing alarm processing strategies have problems such as low recognition accuracy and low processing efficiency when dealing with complex alarm storms, making it difficult to effectively distinguish important alarms from irrelevant alarms, and even more unable to ensure that important alarms are promptly responded while guaranteeing the processing speed. Summary of the Invention

[0004] The present invention provides an alarm storm detection and processing method, device, equipment, medium and product. Through intelligent detection and differential processing, important alarms are preferentially processed, effectively reducing the impact of alarm storms on system resources and improving the fault management efficiency.

[0005] The present invention provides an alarm storm detection and processing method, including: Obtain alarm data that meets preset conditions, and preprocess the alarm data; Perform dimension arrangement on the preprocessed alarm data through an alarm dimension arranger with a preset dimension to obtain at least one alarm data set corresponding to the preset dimension; Select at least one threshold coefficient generator to respectively generate threshold coefficients corresponding to each alarm data set; Obtain the alarm data to be detected, determine the alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficient corresponding to the dimension and timestamp. If the number of alarms in the alarm data to be detected exceeds the alarm threshold value, it is determined that there is an alarm storm; Based on a preset alarm data transfer device, convert the abnormal alarm data corresponding to the alarm storm to an abnormal queue.

[0006] As an embodiment, the determining the alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficient corresponding to the dimension and timestamp includes: Determine a target time window corresponding to the to-be-detected alarm data and a target alarm count within the target time window according to the dimension and timestamp of the to-be-detected alarm data; Determine an average value and a standard deviation corresponding to the target alarm count according to the target alarm count and historical alarm counts within at least one time window before the target time window; Substitute the average value and standard deviation corresponding to the target alarm count, the threshold coefficient corresponding to the dimension and timestamp, and a preset standard deviation adjustment factor into a preset threshold calculation formula to determine the alarm threshold value.

[0007] As an embodiment, obtaining alarm data meeting preset conditions and preprocessing the alarm data includes: Obtain all the alarm data in real time based on a streaming computing framework, or obtain the alarm data corresponding to the dimension of the alarm dimension orchestrator based on the alarm dimension orchestrator, or obtain the corresponding alarm data based on a preset time granularity; Perform data cleaning, deduplication and formatting, classification and marking on the alarm data to complete the preprocessing.

[0008] As an embodiment, the preset dimension includes at least one of a spatial dimension, a time dimension, and a service dimension, and the alarm dimension orchestrator is further configured to perform statistics on the processed alarm data according to the preset dimension.

[0009] As an embodiment, the threshold coefficient generator is determined based on a machine learning algorithm. Correspondingly, selecting at least one threshold coefficient generator to respectively generate threshold coefficients corresponding to each alarm data set includes: Input the statistical data of each alarm data set into the corresponding threshold coefficient generator respectively. The threshold coefficient generator is configured to generate the threshold coefficient according to the proportion of the alarm data set, and the proportion of the alarm data set is used to represent the importance of the alarm data set in alarm storm detection.

[0010] As an embodiment, after determining that there is an alarm storm when the alarm count of the to-be-detected alarm data exceeds the alarm threshold value, it further includes: Determine a multiple or difference between the alarm count of the to-be-detected alarm data and the alarm threshold value, and determine the level of the alarm storm according to the multiple or difference.

[0011] The present invention also provides an alarm storm detection and processing device, including: An acquisition and preprocessing module, configured to acquire alarm data meeting preset conditions and preprocess the alarm data; A dimension arrangement module, configured to perform dimension arrangement on the preprocessed alarm data through an alarm dimension arranger with preset dimensions, so as to obtain at least one alarm data set corresponding to the preset dimensions; A threshold coefficient generation module, configured to select at least one threshold coefficient generator to respectively generate threshold coefficients corresponding to each of the alarm data sets; An alarm storm detection module, configured to obtain alarm data to be detected, determine an alarm threshold value according to the dimensions and timestamps of the alarm data to be detected and the threshold coefficients corresponding to the dimensions and timestamps, and if the number of alarms of the alarm data to be detected exceeds the alarm threshold value, determine that there is an alarm storm; An alarm storm processing module, configured to convert abnormal alarm data corresponding to the alarm storm to an abnormal queue based on a preset alarm data transfer device.

[0012] The present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the alarm storm detection and processing method or the alarm storm detection and processing method as described in any one of the above is implemented.

[0013] The present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the alarm storm detection and processing method or the alarm storm detection and processing method as described in any one of the above is implemented.

[0014] The present invention further provides a computer program product, including a computer program. When the computer program is executed by a processor, the alarm storm detection and processing method or the alarm storm detection and processing method as described in any one of the above is implemented.

[0015] The alarm storm detection and processing method, device, equipment, medium, and product provided by the present invention perform dimension arrangement on the preprocessed alarm data through an alarm dimension arranger with preset dimensions, can flexibly capture key information, thereby avoiding false alarms and missed alarms; generate threshold coefficients corresponding to each of the alarm data sets through a threshold coefficient generator respectively, improving the sensitivity and accuracy of alarm detection; convert abnormal alarm data corresponding to the alarm storm to an abnormal queue based on a preset alarm data transfer device, preventing storm alarms from continuing to occupy resources and ensuring that alarms with higher levels can be normally processed. Description of the Drawings

[0016] To more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0017] Figure 1 It is one of the schematic flowcharts of the alarm storm detection and processing method provided by the present invention.

[0018] Figure 2 It is the second schematic flowchart of the alarm storm detection and processing method provided by the present invention.

[0019] Figure 3 It is the schematic flowchart of the calculation process of the alarm threshold value provided by the present invention.

[0020] Figure 4 It is the schematic diagram of the alarm data shunting provided by the present invention.

[0021] Figure 5 It is the schematic structural diagram of the alarm storm detection and processing device provided by the present invention.

[0022] Figure 6 It is the schematic structural diagram of the electronic device provided by the present invention. Detailed implementation manners

[0023] To make the objectives, technical solutions, and advantages of the present invention clearer, the following will clearly and completely describe the technical solutions in the present invention in conjunction with the drawings in the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

[0024] The following will describe in detail an alarm storm detection and processing method, device, equipment, medium, and product provided by the present invention in conjunction with the drawings.

[0025] Figure 1 It is one of the schematic flowcharts of the alarm storm detection and processing method provided by the present invention. Figure 2 It is the second schematic flowchart of the alarm storm detection and processing method provided by the present invention. As Figure 1 and Figure 2 shown, the present invention provides an alarm storm detection and processing method, which can be used in a fault management system and at least includes step S100-step S500.

[0026] Step S100, obtain alarm data that meets preset conditions, and preprocess the alarm data.

[0027] Step S200: Orchestrate the dimension of the preprocessed alarm data through an alarm dimension orchestrator with a preset dimension to obtain at least one alarm data set corresponding to the preset dimension.

[0028] Optionally, the preset dimension includes at least one of a spatial dimension, a temporal dimension, and a service dimension, and the alarm dimension orchestrator is further configured to perform statistics on the processed alarm data according to the preset dimension.

[0029] The spatial dimension covers keyword fields such as alarm source, alarm network element, province, city, and computer room, which helps to accurately locate the geographical location and physical environment where the alarm occurs; the service dimension includes specialty, alarm level, alarm title, etc., which helps to deeply understand the impact degree and nature of the alarm on the service; the temporal dimension: involves the alarm occurrence time and the alarm discovery time, which provides an important basis for analyzing the time distribution and trend of the alarm.

[0030] The user can flexibly configure the alarm dimension orchestrator, set the data dimensions and their statistical methods (such as summation, average, maximum, minimum, etc.) required for alarm storm detection, and realize diversified statistics and analysis of alarm data, providing a solid foundation for the comprehensive analysis of alarm data.

[0031] Step S300: Select at least one threshold coefficient generator to generate threshold coefficients corresponding to each of the alarm data sets respectively. The threshold coefficient generator is used to generate threshold coefficients for alarm storm detection according to the values output by the alarm dimension orchestrator, so as to realize comprehensive, flexible and efficient analysis and processing of alarm data, and provide strong support for the alarm storm detection and disposal of the fault management system.

[0032] Step S400: Obtain the alarm data to be detected, determine the alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficient corresponding to the dimension and timestamp. If the number of alarms in the alarm data to be detected exceeds the alarm threshold value, it is determined that there is an alarm storm, and the alarm data with an alarm storm is used as abnormal alarm data.

[0033] Compare the preprocessed alarm data with the generated threshold, and judge whether there is an alarm storm according to the comparison result. If certain dimensions (such as quantity, frequency, etc.) of the alarm data exceed the alarm threshold value, it is determined that there is an alarm storm.

[0034] Step S500: Based on a preset alarm data transfer device, convert the abnormal alarm data corresponding to the alarm storm to an abnormal queue to realize the shunt of abnormal alarm data and normal alarm data.

[0035] The alarm data transfer device is an integration of several rules. In other words, the alarm data transfer device is implemented through the setting of some rules. The condition fields of these rules are usually "alarm level", "alarm title", "alarm type", etc. By adding conditions such as: alarm level = "Level 1 alarm", the alarms that meet this condition are transferred. The transfer method can be to put them into a cache queue with a relatively low priority, and then transfer the alarms in the low-priority cache queue back for processing after the storm has passed.

[0036] It can be understood that through the alarm dimension orchestrator with preset dimensions to perform dimension orchestration on the preprocessed alarm data, the present invention can flexibly capture key information, thereby avoiding false alarms and missed alarms; by generating threshold coefficients corresponding to each of the alarm data sets respectively through the threshold coefficient generator, the sensitivity and accuracy of alarm detection are improved; based on the preset alarm data transfer device, the abnormal alarm data corresponding to the alarm storm is converted to an abnormal queue, preventing the storm alarms from continuing to occupy resources and ensuring that the alarms with a relatively high level can be processed normally.

[0037] On the basis of the above embodiment, as an optional embodiment, obtaining the alarm data that meets the preset conditions and preprocessing the alarm data includes steps S110 - step S120.

[0038] Step S110, obtaining all the alarm data in real time based on a streaming computing framework, or obtaining the alarm data corresponding to the dimensions of the alarm dimension orchestrator based on the alarm dimension orchestrator, or obtaining the corresponding alarm data based on a preset time granularity.

[0039] There are three ways to collect alarm data. One is real-time collection. Using a streaming computing framework such as Flink to collect the alarm data generated by the system in real time. The key information of the alarm data includes alarm time, alarm source, alarm content, etc. The second is the collection method based on dimension expansion. By introducing an alarm dimension orchestrator, the collection dimensions of the alarm data can be flexibly configured according to business requirements. In addition to the conventional alarm time, alarm source, and alarm content, dimension information such as alarm level, influence range, and associated resources can also be added. The alarm dimension orchestrator allows the data source to be extended at any time to adapt to the changing business requirements. The third is the collection method based on time granularity statistics. According to different time granularities (such as seconds, minutes, hours, etc.), using the window mechanism of Flink and the selected statistical method to perform real-time statistics on the alarm data, and the statistical results are saved to a distributed storage system (such as HDFS or Cassandra) for subsequent analysis and traceability.

[0040] Step S120, performing data cleaning, deduplication and formatting, classification and marking on the alarm data to complete the preprocessing.

[0041] Data cleaning: Clean the collected alarm data to remove invalid, duplicate, or abnormal data; the cleaning process is guided by the cleaning rules configured by the alarm dimension orchestrator to ensure the accuracy and consistency of the data.

[0042] Duplicate removal and formatting: Remove duplicates from the alarm data to avoid interference from duplicate data, and format the alarm data into a unified standard format for subsequent analysis and processing.

[0043] Classification and marking: Use the classification rules configured by the alarm dimension orchestrator to preliminarily classify and mark the alarm data. The classification and marking results can facilitate subsequent analysis and improve the analysis efficiency and accuracy.

[0044] It can be understood that the present invention can select different alarm data collection schemes according to business requirements, and then preprocess the collected alarm data, which is beneficial to improving the accuracy of alarm data management.

[0045] Based on the above embodiments, as an optional embodiment, the threshold coefficient generator is determined based on a machine learning algorithm. Correspondingly, the step of selecting at least one threshold coefficient generator to generate threshold coefficients corresponding to each of the alarm data sets respectively includes: Input the statistical data of each of the alarm data sets into the corresponding threshold coefficient generator respectively. The threshold coefficient generator is used to generate the threshold coefficient according to the proportion of the alarm data set, and the proportion of the alarm data set is used to represent the importance of the alarm data set in alarm storm detection.

[0046] The structure of the threshold coefficient generator includes an alarm data set statistics setting module (statistics method setting), a proportion configuration module (the proportion of each statistics method in generating the coefficient), a training model configuration module (prediction model selection), and a threshold coefficient calculation module. The threshold coefficient generator further processes and configures the values obtained from the statistics of the alarm data sets in each dimension to generate a threshold coefficient for alarm storm detection. Users can set the threshold coefficient generator in terms of proportion configuration, model training, data preprocessing, and threshold calculation method, etc. There are multiple statistics methods for statistical alarms, and the proportion configuration specifically refers to configuring the proportion of each statistics method in generating the coefficient.

[0047] Users can configure the proportion of the generation coefficients for each dimension according to the statistical data of the selected dimensions to reflect the importance of different dimensions in alarm storm detection. For example, a certain spatial dimension may account for 30%, a certain business dimension accounts for 20%, and the time type accounts for 50%, etc. In other embodiments, it is also possible to select whether to perform machine learning algorithm model training on the statistical data of the selected dimensions to improve the accuracy and efficiency of alarm storm detection. The trained model can be used to generate more accurate threshold coefficients. In other embodiments, it is also possible to configure whether to preprocess the statistical data of the selected dimensions and select specific data preprocessing methods, such as data cleaning, data standardization, etc., to ensure the accuracy and consistency of the data. In other embodiments, it is also possible to configure whether to use a dynamic calculation method to determine the threshold to meet the alarm storm detection requirements in different scenarios.

[0048] According to the statistical data of the selected dimensions, configure the proportion of the generation coefficients for each dimension through a threshold coefficient generator to reflect its importance in alarm storm detection. If the user chooses to perform model training, use a machine learning algorithm to train the historical data of the statistics of the selected dimensions to improve the accuracy and efficiency of alarm storm detection. The trained model is generally a serialized data file, which is loaded into the program for predicting or generating new data. Specifically, it can be used to generate more accurate threshold coefficients. According to the user configuration, determine the calculation method of the threshold. If a dynamic calculation method is used, the alarm threshold is dynamically adjusted according to the historical data and real-time data to meet the alarm storm detection requirements in different scenarios. If a static calculation method is used, calculate according to the preset threshold to generate a threshold coefficient for alarm storm detection, denoted as k.

[0049] It can be understood that through the collaborative work of the alarm dimension orchestrator and the threshold coefficient generator, the present invention can achieve comprehensive, flexible, and efficient analysis and processing of alarm data, providing strong support for alarm storm detection and disposal in the fault management system.

[0050] Figure 3 is a schematic diagram of the calculation process of the alarm threshold value provided by the present invention. As Figure 3 shown, on the basis of the above embodiments, as an optional embodiment, determining the alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficient corresponding to the dimension and timestamp includes steps S410 - step S430.

[0051] Step S410, according to the dimension and timestamp of the alarm data to be detected, determine the target time window corresponding to the alarm data to be detected and the target number of alarms within the target time window.

[0052] Step S420: Determine the average value and standard deviation corresponding to the target alarm quantity based on the target alarm quantity and the historical alarm quantities within at least one time window before the target time window.

[0053] Step S430: Substitute the average value and standard deviation corresponding to the target alarm quantity, the threshold coefficient corresponding to the dimension and timestamp, and a preset standard deviation adjustment factor into a preset threshold calculation formula to determine the alarm threshold value.

[0054] The relevant parameters of the alarm threshold value calculation algorithm provided by the present invention include dimension D, time window W, the number of alarms within the time window (representing the number of alarms under dimension D and time t), sliding step size s, threshold coefficient k, and the threshold value under dimension D and time t. 。

[0055] In the initial stage of time window W, for each dimension D, collect all alarm data and calculate the average value of the number of alarms. and standard deviation (or select other statistics as needed). n is the number of sampling time windows. Set an initial threshold coefficient k. Usually, the value of k can be determined empirically as 3, k = 3 (indicating that the threshold value is 3 times the average value).

[0056] The calculation formula for the initial threshold value is as follows: The calculation formula for the average value is as follows: The calculation formula for the standard deviation is as follows: Among them, is the number of alarm data in the j-th time window.

[0057] When new alarm data arrives, according to its dimension D and timestamp, statistically update the number of alarms within time window W . Take the data within the n time windows in front of time window W to calculate the new average value and standard deviation (or update other statistics). According to the new average value and threshold coefficient , calculate the new threshold value , where is the standard deviation adjustment factor to balance the sensitivity of storm discovery and the false alarm rate.

[0058] For each newly arrived alarm, according to its dimension D and timestamp t, obtain the threshold value from the corresponding dimension and time window model. . Determine whether the current number of alarms exceeds the threshold value , if it exceeds, trigger the storm mode. Slide the time window forward by s steps and continue to collect new alarm data.

[0059] It can be understood that the threshold coefficient generator dynamically adjusts the alarm threshold according to historical data and business rules, improving the sensitivity and accuracy of alarm detection.

[0060] Based on the above embodiments, as an optional embodiment, after determining that there is an alarm storm when the number of alarms in the to-be-detected alarm data exceeds the alarm threshold value, it further includes step S600.

[0061] Step S600, determine the multiple or difference between the number of alarms in the to-be-detected alarm data and the alarm threshold value, and determine the level of the alarm storm according to the multiple or difference.

[0062] The present invention can notify according to the severity of the alarm storm, which is divided into four levels: "Emergency", "Severe", "Warning" and "Information" for priority processing. Using an efficient notification mechanism (such as the subscription mechanism of zookeeper), when a storm occurs, the message is published to zookeeper through an interface call, and the subscribed alarm processing program performs corresponding processing after receiving the notification, allowing the system to dynamically respond to the alarm storm without restarting the service.

[0063] Such as Figure 4 shown, the present invention has an alarm transfer device in the storm mode to divert the alarms in the alarm storm mode. When the disposal program receives the notification and enters the storm mode, it performs abnormal diversion on the discovered abnormal data. For example, when it is found that a certain OMC (underlying centralized network management system, generally provided by equipment manufacturers, providing original alarm data) has an abnormality, the alarm real-time processing program is notified through an interface to transfer the alarms of this OMC to the abnormal message queue. This process is a real-time notification and takes effect immediately without restarting the program. When the storm ends, the diversion is notified through the interface to restore the normal alarm processing flow. Prevent storm alarms from continuing to occupy resources during the storm and ensure that alarms with higher levels continue to be processed normally.

[0064] It should be noted that the execution order of step S600 and step S500 can be adjusted, and the present invention does not limit this.

[0065] In summary, the present invention has the following advantages: Improve the accuracy of alarm detection: Through fine alarm dimension arrangement, key information can be flexibly captured, thus avoiding false alarms and missed alarms. The threshold coefficient generator dynamically adjusts the alarm threshold according to historical data and business rules, improving the sensitivity and accuracy of alarm detection; Enhance the system's response speed: After detecting an alarm, it can quickly trigger a processing mechanism, including generating alarm notifications, recording logs, and triggering emergency responses, thereby shortening the response time. The introduction of the storm handling mechanism enables the system to quickly locate the root cause of problems when facing a large number of alarms and take effective handling measures, further improving the response speed. Through comprehensive monitoring and analysis of alarm data, potential problems can be discovered and solved in a timely manner, thus avoiding system crashes or failures caused by the accumulation of problems. The data storage and transmission mechanism ensures the accuracy, integrity, and timeliness of data, providing a strong guarantee for stable operation; Optimize resource utilization and cost-effectiveness: Through refined alarm handling and storm handling mechanisms, unnecessary resource waste and duplicate investments are avoided. The transfer of alarm data and device management enable the fault management system to make more effective use of existing resources, improving cost-effectiveness. Improve user experience and satisfaction: Timely alarm notifications and effective handling measures can reduce the losses suffered by users due to system problems, thereby increasing users' trust and satisfaction with the system. The ease of use and flexibility of the system enable users to configure and adjust according to their own needs.

[0066] The alarm storm detection and handling device provided by the present invention will be described below. The alarm storm detection and handling device described below can be mutually corresponding and referred to the alarm storm detection and handling method described above.

[0067] Figure 5 It is a schematic structural diagram of the alarm storm detection and handling device provided by the present invention. As Figure 5 shown, the present invention also provides an alarm storm detection and handling device, including: An acquisition and preprocessing module 510, configured to acquire alarm data that meets preset conditions and preprocess the alarm data; A dimension arrangement module 520, configured to arrange the preprocessed alarm data through an alarm dimension arranger with a preset dimension to obtain at least one alarm data set corresponding to the preset dimension; A threshold coefficient generation module 530, configured to select at least one threshold coefficient generator to respectively generate threshold coefficients corresponding to each alarm data set; An alarm storm detection module 540, configured to acquire alarm data to be detected, determine an alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficient corresponding to the dimension and timestamp, and if the number of alarms of the alarm data to be detected exceeds the alarm threshold value, determine that there is an alarm storm; An alarm storm handling module 550, configured to convert the abnormal alarm data corresponding to the alarm storm to an abnormal queue based on a preset alarm data transfer device.

[0068] As an embodiment, the alarm storm detection module 540 is further configured to: Determine a target time window corresponding to the alarm data to be detected and a target alarm quantity within the target time window according to the dimension and timestamp of the alarm data to be detected; Determine an average value and a standard deviation corresponding to the target alarm quantity according to the target alarm quantity and historical alarm quantities within at least one time window before the target time window; Substitute the average value and standard deviation corresponding to the target alarm quantity, the threshold coefficient corresponding to the dimension and timestamp, and a preset standard deviation adjustment factor into a preset threshold calculation formula to determine the alarm threshold value.

[0069] As an embodiment, the acquisition and preprocessing module 510 is further configured to: Obtain all the alarm data in real time based on a streaming computing framework, or obtain the alarm data corresponding to the dimension of the alarm dimension orchestrator based on the alarm dimension orchestrator, or obtain the corresponding alarm data based on a preset time granularity; Perform data cleaning, duplicate removal, formatting, classification, and marking on the alarm data to complete preprocessing.

[0070] As an embodiment, the preset dimension includes at least one of a spatial dimension, a time dimension, and a service dimension, and the alarm dimension orchestrator is further configured to perform statistics on the processed alarm data according to the preset dimension.

[0071] As an embodiment, the threshold coefficient generator is determined based on a machine learning algorithm. Correspondingly, the threshold coefficient generation module 530 is further configured to: Input the statistical data of each alarm data set into the corresponding threshold coefficient generator respectively. The threshold coefficient generator is configured to generate the threshold coefficient according to the proportion of the alarm data set, and the proportion of the alarm data set is used to represent the importance of the alarm data set in alarm storm detection.

[0072] As an embodiment, the alarm storm processing module 550 is further configured to: Determine a multiple or difference between the alarm quantity of the alarm data to be detected and the alarm threshold value, and determine the level of the alarm storm according to the multiple or difference.

[0073] It should be noted that the alarm storm detection and processing device provided by the present invention can execute the alarm storm detection and processing method described in any of the above embodiments during specific operation, and has technical effects corresponding to the method. Details are not described in this embodiment.

[0074] Figure 6The figure illustrates a schematic diagram of the physical structure of an electronic device, as Figure 6 shown. The electronic device may include: a processor 610, a communications interface 620, a memory 630, and a communication bus 640. Among them, the processor 610, the communications interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 may invoke the logical instructions in the memory 630 to execute an alarm storm detection and processing method, including: obtaining alarm data that meets preset conditions and preprocessing the alarm data; performing dimensional arrangement on the preprocessed alarm data through an alarm dimensional arranger with a preset dimension to obtain at least one alarm data set corresponding to the preset dimension; selecting at least one threshold coefficient generator to generate threshold coefficients corresponding to each of the alarm data sets; obtaining alarm data to be detected, determining an alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficients corresponding to the dimension and timestamp, and if the number of alarms of the alarm data to be detected exceeds the alarm threshold value, determining that there is an alarm storm; and converting the abnormal alarm data corresponding to the alarm storm to an abnormal queue based on a preset alarm data transfer device.

[0075] In addition, when the logical instructions in the above-mentioned memory 630 are implemented in the form of software functional units and sold or used as an independent product, they may be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk, or an optical disc that can store program codes.

[0076] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the alarm storm detection and processing method provided by the above-mentioned various methods, including: obtaining alarm data that meets preset conditions, and preprocessing the alarm data; performing dimension arrangement on the preprocessed alarm data through an alarm dimension arranger with a preset dimension to obtain at least one alarm data set corresponding to the preset dimension; selecting at least one threshold coefficient generator to respectively generate threshold coefficients corresponding to each alarm data set; obtaining the alarm data to be detected, determining an alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficients corresponding to the dimension and timestamp. If the number of alarms of the alarm data to be detected exceeds the alarm threshold value, it is determined that there is an alarm storm; based on a preset alarm data transfer device, converting the abnormal alarm data corresponding to the alarm storm to an abnormal queue.

[0077] On another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is implemented to execute the alarm storm detection and processing method provided by the above-mentioned various methods, including: obtaining alarm data that meets preset conditions, and preprocessing the alarm data; performing dimension arrangement on the preprocessed alarm data through an alarm dimension arranger with a preset dimension to obtain at least one alarm data set corresponding to the preset dimension; selecting at least one threshold coefficient generator to respectively generate threshold coefficients corresponding to each alarm data set; obtaining the alarm data to be detected, determining an alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficients corresponding to the dimension and timestamp. If the number of alarms of the alarm data to be detected exceeds the alarm threshold value, it is determined that there is an alarm storm; based on a preset alarm data transfer device, converting the abnormal alarm data corresponding to the alarm storm to an abnormal queue.

[0078] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without creative labor.

[0079] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of each embodiment of the present invention.

Claims

1. A method for detecting and processing an alarm storm, characterized in that: include: Acquire alarm data that meets preset conditions and pre-process the alarm data; Performing dimension arrangement on the pre-processed alarm data by using an alarm dimension arranger of a preset dimension to obtain at least one alarm data set corresponding to the preset dimension; Selecting at least one threshold coefficient generator to respectively generate threshold coefficients corresponding to each of the alarm data sets; Acquire the alarm data to be detected, determine the alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficient corresponding to the dimension and timestamp, and determine that an alarm storm exists if the alarm quantity of the alarm data to be detected exceeds the alarm threshold value; Based on the preset alarm data transfer device, the abnormal alarm data corresponding to the alarm storm is converted to the abnormal queue.

2. The method for detecting and processing an alarm storm according to claim 1, characterized in that: The determining the alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficient corresponding to the dimension and timestamp includes: Determine, according to the dimension and timestamp of the alarm data to be detected, a target time window corresponding to the alarm data to be detected and a target alarm quantity within the target time window; Determine a mean value and a standard deviation corresponding to the target alarm number according to the target alarm number and a historical alarm number in at least one time window before the target time window; The average value and standard deviation corresponding to the target alarm quantity, the threshold coefficient corresponding to the dimension and timestamp, and the preset standard deviation adjustment factor are substituted into the preset threshold calculation formula to determine the alarm threshold value.

3. The method for detecting and processing an alarm storm according to claim 1, characterized in that: The obtaining of alarm data that meets the preset conditions and preprocessing the alarm data includes: Acquire all the alarm data in real time based on the streaming computing framework, or, based on the alarm dimension orchestrator, acquire the alarm data corresponding to the dimension of the alarm dimension orchestrator, or, based on a preset time granularity, acquire the corresponding alarm data; The alarm data is cleaned, deduplicated, formatted, classified and marked to complete preprocessing.

4. The method for detecting and processing an alarm storm according to claim 1 or 3, characterized in that: The preset dimension includes at least one of a space dimension, a time dimension and a business dimension, and the alarm dimension organizer is further used to perform statistics on the processed alarm data according to the preset dimension.

5. The method for detecting and processing an alarm storm according to claim 1, characterized in that: The threshold coefficient generator is determined based on a machine learning algorithm, and correspondingly, the at least one threshold coefficient generator is selected to respectively generate threshold coefficients corresponding to each of the alarm data sets, including: The statistical data of each alarm data set are respectively input into the corresponding threshold coefficient generator, and the threshold coefficient generator is used to generate the threshold coefficient according to the proportion of the alarm data set, and the proportion of the alarm data set is used to characterize the importance of the alarm data set in alarm storm detection.

6. The method for detecting and processing an alarm storm according to claim 1, characterized in that: After the alarm quantity of the alarm data to be detected exceeds the alarm threshold value and it is determined that an alarm storm exists, the method further includes: The multiple or difference between the alarm quantity of the alarm data to be detected and the alarm threshold value is determined, and the level of the alarm storm is determined according to the multiple or the difference.

7. An alarm storm detection and processing device, characterized in that: include: An acquisition and preprocessing module, used to acquire alarm data that meets preset conditions and preprocess the alarm data; A dimension arrangement module, used for dimensionally arranging the pre-processed alarm data through an alarm dimension arranger of a preset dimension to obtain at least one alarm data set corresponding to the preset dimension; A threshold coefficient generating module, used for selecting at least one threshold coefficient generator to respectively generate threshold coefficients corresponding to each of the alarm data sets; An alarm storm detection module is used to obtain alarm data to be detected, determine an alarm threshold value according to the dimension and timestamp of the alarm data to be detected and the threshold coefficient corresponding to the dimension and timestamp, and determine that an alarm storm exists if the number of alarms of the alarm data to be detected exceeds the alarm threshold value; The alarm storm processing module is used to convert the abnormal alarm data corresponding to the alarm storm into the abnormal queue based on the preset alarm data transfer device.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the alarm storm detection and processing method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the alarm storm detection and processing method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the alarm storm detection and processing method according to any one of claims 1 to 6 is implemented.

Images