Low-level alarm management method and device

Abstract

The invention discloses a low-level alarm management method and device. The method comprises the following steps: receiving a low-level alarm, and respectively storing a first alarm caused by a network element fault, a second alarm caused by a user behavior and a third alarm caused by network management equipment upgrading into corresponding databases; detecting the alarm flow written into the first database in real time, and analyzing the alarm in the first database when the alarm flow meets a preset condition; periodically utilizing the time sequence prediction model to analyze the alarms in the second database, and analyzing the alarms in the second database when the predicted number of the second alarms is not matched with the actual number of the second alarms; analyzing alarms in a third database in response to the alarm analysis instruction; and corresponding early warning notifications are generated based on analysis results of different alarms. The technical problems that a related alarm management scheme focuses on responding to high-grade alarms, and the analysis and early warning capability on low-grade alarms is insufficient are solved.

Description

Technical Field

[0001] The present application relates to the technical field of network alarm management, and in particular to a low-level alarm management method and device. Background Art

[0002] In today's rapidly developing communications network environment, the complexity of network equipment and systems continues to rise, resulting in a massive influx of alarm information. These alarms range from minor anomalies to severe failures. Low-severity alarms are often classified as "non-urgent" due to their apparent minimal impact on business, and often receive less attention in alarm management systems. However, the recurrence or abnormal occurrence of low-severity alarms often indicates potential network health issues. If these issues are not identified and addressed promptly, they may quietly accumulate and eventually become hidden dangers that pose a significant threat to business stability.

[0003] Traditional alarm processing methods rely primarily on predefined rules and thresholds. While effective for handling high-level, urgent alarms, they struggle to cope with the complexity and diversity of low-level alarms. On the one hand, this fixed processing model struggles to capture the dynamic changes and underlying patterns inherent in low-level alarms, resulting in delayed problem discovery. On the other hand, faced with massive amounts of low-level alarm data, the system often struggles to quickly and accurately filter and analyze it, resulting in wasted resources and inefficient processing. Furthermore, different network environments and device types may generate low-level alarms of varying nature and frequency, and traditional, single-source alarm processing strategies cannot meet these diverse needs. Therefore, accurately identifying potential network failure points from a multitude of low-level alarms, providing early warnings and implementing preventative measures, has become a key issue that needs to be addressed in the current network operations and maintenance field.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present application provide a low-level alarm management method and device to at least solve the technical problem that related alarm management solutions focus on responding to high-level alarms and have insufficient analysis and early warning capabilities for low-level alarms.

[0006] According to one aspect of an embodiment of the present application, a low-level alarm management method is provided, including: receiving an alarm with an alarm level lower than a preset level, storing the first alarm in a first database when the alarm is a first alarm caused by a network element failure, storing the second alarm in a second database when the alarm is a second alarm caused by user behavior, and storing the third alarm in a third database when the alarm is a third alarm caused by a network management device upgrade; detecting the alarm stream written to the first database in real time, analyzing the first alarm in the first database when the alarm stream meets the preset trigger condition, and generating a first early warning notification based on the analysis result; periodically analyzing the second alarm in the second database using a time series prediction model, and when the predicted number of second alarms does not match the actual number of second alarms, analyzing the second alarm in the second database, and generating a second early warning notification based on the analysis result; analyzing the third alarm in the third database in response to the alarm analysis instruction, and generating a third early warning notification based on the analysis result.

[0007] Optionally, when the alarm stream meets the preset trigger condition, the first alarm in the first database is analyzed, and a first warning notification is generated based on the analysis result, including: if the frequency of occurrence of the same type of alarm in the alarm stream exceeds a preset frequency threshold, determining that the alarm stream meets the trigger condition; determining the first number of first alarms in the first database in the first historical period including the trigger moment, the second number of first alarms in multiple consecutive second sub-historical periods in the second historical period including the trigger moment, and the third number of first alarms in each third historical period in multiple consecutive days including the first historical period, wherein the second sub-historical period is the same length as the first historical period, and the third historical period is the same time as the first historical period; determining the maximum value among the multiple third quantities, determining the average value of the multiple second quantities, and determining the product of the average value and a preset coefficient; when the first number is greater than the maximum value or the product, clustering the multiple first alarms in the first historical period, and locating the first alarm in each obtained cluster cluster; generating a first warning notification based on the clustering result and the positioning result.

[0008] Optionally, multiple first alarms within the first historical period are clustered, and the first alarms in each obtained cluster are located, including: using a preset clustering algorithm to cluster multiple first alarms within the first historical period from a target dimension to obtain multiple clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; for each cluster, the faulty network element is located based on the similarity between the first alarms in the cluster, wherein the dimension of similarity includes at least one of the following: alarm text similarity, alarm location similarity, and IP similarity.

[0009] Optionally, the time series prediction model is used to periodically analyze the second alarms in the second database. When the predicted number of second alarms does not match the actual number of second alarms, the second alarms in the second database are analyzed, and a second early warning notification is generated based on the analysis results, including: at each analysis moment, determining the fourth number of second alarms in the second database in a fourth historical period including the analysis moment, the fifth number of second alarms in a plurality of consecutive fifth sub-historical periods in a fifth historical period before the fourth historical period, and the sixth number of second alarms in each sixth historical period in a plurality of consecutive days before the fourth historical period, wherein the fifth sub-historical period is the same as the fourth historical period. The duration is the same, and the sixth historical period is the same as the fourth historical period; the pre-trained first time series prediction model is used to analyze the time series composed of multiple fifth quantities, and the seventh number of second alarms in the predicted fourth historical period is obtained; the pre-trained second time series prediction model is used to analyze the time series composed of multiple sixth quantities, and the eighth number of second alarms in the predicted fourth historical period is obtained; when the fourth number is greater than the maximum value of the seventh number or the eighth number or the sixth number, the multiple second alarms in the fourth historical period are clustered, and the second alarms in each cluster cluster obtained are located; a second early warning notification is generated based on the clustering results and the positioning results.

[0010] Optionally, multiple second alarms within the fourth historical period are clustered, and the second alarms in each obtained cluster are located, including: using a preset clustering algorithm to cluster multiple second alarms within the fourth historical period from a target dimension to obtain multiple clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; for each cluster, risk network element location is performed based on the similarity between the second alarms in the cluster, wherein the dimension of similarity includes at least one of the following: alarm text similarity, alarm location similarity, and IP similarity.

[0011] Optionally, the training process of the first time series prediction model and the second time series prediction model includes: constructing an initial prediction model, wherein the type of the initial prediction model includes at least one of the following: a long short-term memory network model, a gated recurrent unit, and a Transformer model; obtaining multiple first samples from the second database based on a preset sliding time window, wherein each first sample includes a time series consisting of the ninth number of second alarms in multiple consecutive seventh historical periods, and the sample label of the first sample is the ninth number of second alarms in the next seventh historical period after multiple consecutive seventh historical periods; obtaining multiple second samples from the second database based on a preset periodic time window, wherein each second sample includes a time series consisting of the tenth number of second alarms in each eighth historical period in multiple consecutive days, and the sample label of the second sample is the tenth number of second alarms in the eighth historical period of the next day after multiple consecutive days, and the time of each eighth historical period is the same; using multiple first samples and sample labels to iteratively train the initial prediction model to obtain a first time series prediction model; using multiple second samples and sample labels to iteratively train the initial prediction model to obtain a second time series prediction model.

[0012] Optionally, the third alarm in the third database is analyzed, and a third early warning notification is generated based on the analysis results, including: using a preset clustering algorithm to cluster multiple third alarms in the third database within the ninth historical period including the instruction reception moment from a target dimension to obtain multiple cluster clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; for each cluster cluster, risk network management equipment is located based on the similarity between each third alarm in the cluster cluster, wherein the dimension of similarity includes at least one of the following: alarm text similarity, alarm location similarity, IP similarity; and a third early warning notification is generated based on the clustering results and the positioning results.

[0013] Optionally, the above method also includes: sending the target warning notification to the target object based on a preset notification method, wherein the target warning notification is the first warning notification and / or the second warning notification and / or the third warning notification; the target warning notification includes at least one of the following contents generated based on a preset format: alarm clustering results, alarm positioning results, alarm data curve chart; the preset notification method includes at least one of the following: email notification, SMS notification, enterprise WeChat notification.

[0014] According to another aspect of an embodiment of the present application, a low-level alarm management device is also provided, including: a storage module for receiving alarms with an alarm level lower than a preset level, and storing the first alarm in a first database when the alarm is a first alarm caused by a network element failure; storing the second alarm in a second database when the alarm is a second alarm caused by user behavior; and storing the third alarm in a third database when the alarm is a third alarm caused by an upgrade of a network management device; a first early warning module for detecting the alarm stream written to the first database in real time, and analyzing the first alarm in the first database when the alarm stream meets a preset trigger condition, and generating a first early warning notification based on the analysis result; a second early warning module for periodically analyzing the second alarm in the second database using a time series prediction model, and when the predicted number of second alarms does not match the actual number of second alarms, analyzing the second alarm in the second database, and generating a second early warning notification based on the analysis result; a third early warning module for analyzing the third alarm in the third database in response to an alarm analysis instruction, and generating a third early warning notification based on the analysis result.

[0015] According to another aspect of an embodiment of the present application, an electronic device is provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned low-level alarm management method through the computer program.

[0016] In an embodiment of the present application, for alarms with a received alarm level lower than a preset level, the alarms triggered are classified based on three reasons, namely, network element failure, user behavior, and gateway device upgrade, and are classified and stored in the corresponding database. The classified storage of low-level alarm information is conducive to providing a basis for adopting different monitoring methods according to different situations, so as to facilitate more accurate risk warnings in the later stage. Different monitoring methods are adopted for databases storing different types of low-level alarm information. Real-time detection is performed on the alarm information caused by network element failure stored in the first database, periodic detection is performed on the alarm information caused by user behavior in the second database, and detection is performed on the alarm information caused by network element device upgrade in the third database when an alarm analysis instruction is received. The classified monitoring method of different alarm information is conducive to ensuring the efficient and reasonable use of resources. Specifically, during the detection and analysis, warning notification information is generated for the detection results corresponding to different low-level alarm information respectively. Timely warning feedback helps to improve the efficiency of problem response, thereby solving the technical problem that the relevant alarm management scheme focuses on responding to high-level alarms and lacks the analysis and warning capabilities of low-level alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 This is a flowchart of an optional low-level alarm management method according to an embodiment of the present application;

[0019] Figure 2 This is a schematic diagram of an optional low-level alarm management method process according to an embodiment of the present application;

[0020] Figure 3 is a schematic structural diagram of an optional low-level alarm management device according to an embodiment of the present application;

[0021] Figure 4 This is a schematic diagram of an optional electronic device structure according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0023] It should be noted that the terms "first", "second", etc. in the specification, claims, and drawings of the present application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0024] To better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:

[0025] DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm: DBSCAN is a clustering algorithm used in unsupervised learning. It is particularly well-suited for datasets with complex shapes and sizes, as well as those that may contain noisy points. Compared to traditional clustering algorithms such as K-means, DBSCAN does not require a predefined number of clusters, but instead automatically discovers clusters based on the density distribution of points. This feature makes DBSCAN particularly effective when working with datasets with an uncertain number of clusters or those containing outliers.

[0026] Example 1

[0027] According to an embodiment of the present application, a low-level alarm management method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] Figure 1 This is a flow chart of a low-level alarm management method provided in accordance with an embodiment of the present application, such as Figure 1 As shown, the method includes the following steps:

[0029] Step S102: Receive an alarm with an alarm level lower than a preset level. If the alarm is a first alarm caused by a network element failure, store the first alarm in the first database. If the alarm is a second alarm caused by user behavior, store the second alarm in the second database. If the alarm is a third alarm caused by a network management device upgrade, store the third alarm in the third database.

[0030] First, all received alarm data is classified by level. Alarms below a preset level are stored in specific databases based on their causes. Specifically, alarms caused by network element failures (primary alarms) are stored in the first database, alarms due to abnormal user behavior (secondary alarms) in the second database, and alarms generated during network management equipment upgrades (tertiary alarms) in the third database. This strategy ensures independent management of different alarm types, facilitating subsequent refined analysis and processing.

[0031] Step S104 , detecting the alarm stream written into the first database in real time, analyzing the first alarm in the first database when the alarm stream meets a preset trigger condition, and generating a first warning notification based on the analysis result.

[0032] The system implements a real-time monitoring mechanism for network element fault alarms stored in the first database. Using streaming data processing technology, the written alarm stream is continuously monitored. Once the alarm stream meets specific trigger conditions (such as alarm frequency exceeding normal thresholds or abnormal alarm patterns), the alarm analysis process in the first database is immediately initiated. During the alarm analysis process, machine recognition algorithms such as cluster analysis and pattern recognition can be used to deeply explore the potential connections and patterns behind the alarm data, identify key fault nodes or areas, and generate accurate first warning notifications.

[0033] Step S106: periodically analyze the second alarms in the second database using the time series prediction model. When the predicted number of second alarms does not match the actual number of second alarms, analyze the second alarms in the second database and generate a second warning notification based on the analysis results.

[0034] For the user behavior alarms stored in the second database, this application adopts a periodic inspection combined with an analysis strategy of a time series prediction model. The alarm records in the second database can be read regularly, and the trained time series prediction model can be used to predict the amount of alarms in the future. When the predicted value does not match the actual alarm volume, that is, when the actual alarm volume deviates from the historical trend, the in-depth analysis process is automatically triggered, and the reasons behind the anomaly can be explored through statistical analysis, association rule mining and other means. Based on these analysis results, the system generates a targeted second warning notification to effectively warn of potential user service impacts.

[0035] Step S108: In response to the alarm analysis instruction, analyze the third alarm in the third database, and generate a third warning notification based on the analysis result.

[0036] Users can trigger analysis processes on demand by issuing alert analysis commands specifically for special alerts triggered by network management upgrades in the third database. Operations and maintenance personnel can issue alert analysis commands based on specific needs or concerns. Upon receiving the command, the system immediately analyzes the alerts in the third database, comparing them with historical data using an expert rule base to assess the true risk level of the alerts and generate third-party warning notifications, ensuring network stability and security after special operations such as network management upgrades.

[0037] The following describes the various steps of the low-level alarm management method in conjunction with the specific implementation process.

[0038] Figure 2 A more complete low-level alarm processing method is shown in the flowchart, Figure 2As shown, in a specific implementation, the sources that trigger low-level alarm information are classified, and the alarm information is classified and stored based on the classification. For different types of low-level alarm information, the embodiment of the present application provides different monitoring methods. Different monitoring methods trigger the early warning analysis process when the corresponding conditions are met. The analysis process introduces clustering and positioning analysis, and correspondingly identifies implicit related problems from the alarm information, and finally generates a target early warning notification and pushes it to the target object.

[0039] In the case where the low-level alarm information is caused by a network element failure, the alarm flow written into the first database can be detected in real time, the alarm flow can be monitored, and when the alarm flow meets the preset conditions, the alarm information in the first database can be analyzed, and a first early warning notification can be generated based on the analysis results. This can be achieved in the following way: if the frequency of occurrence of the same type of alarm in the alarm flow exceeds the preset frequency threshold, it is determined that the alarm flow meets the trigger condition; a first number of first alarms in the first historical period including the trigger moment, a second number of first alarms in a plurality of consecutive second sub-historical periods in a second historical period including the trigger moment, and a third number of first alarms in each third historical period in a plurality of consecutive days including the first historical period are determined, wherein the second sub-historical period has the same length as the first historical period, and the third historical period has the same time as the first historical period; a maximum value among the plurality of third quantities is determined, an average value of the plurality of second quantities is determined, and a product of the average value and a preset coefficient is determined; when the first number is greater than the maximum value or the product, the plurality of first alarms in the first historical period are clustered, and the first alarm in each obtained cluster cluster is located; and a first early warning notification is generated based on the clustering result and the positioning result.

[0040] Specifically, the system continuously monitors the alarm stream and collects frequency statistics for the first alarm of the same type (such as "5G base station alarm"). This system sets up continuous 24 / 7 monitoring. If the frequency of an alarm of this type exceeds a pre-set frequency threshold for 10 consecutive minutes, the system immediately marks it as an abnormal alarm stream and triggers a subsequent in-depth analysis process. This mechanism ensures that even seemingly minor alarms can capture signals that may indicate deteriorating network health.

[0041] After the triggering conditions are met, the system immediately conducts an in-depth analysis of the alarm historical data in the first database. Assuming that the abnormal analysis process is triggered at 18:00 on the same day, 17:55-18:00 on the same day can be used as the first historical period, 17:00-18:00 on the same day can be used as the second historical period, and 17:55-18:00 every day in the nearly one-week time period starting from the current day can be used as the third historical period. Among them, 17:00 to 18:00 on the same day (the second historical period) can be divided into 12 second sub-historical periods with a time interval of 5 minutes (the length of the first historical period). When counting alarm information, the number of the above-mentioned types of alarms that appear in the first historical period can be used as the first number, recorded as N m , the number of alarm information appearing in each second sub-historical period is taken as the second number, recorded as N h , then N h is a set of time series, specifically represented by {N h1 , N h2 ,…,N h12}, where N h12 With N m The number of the above-mentioned alarm types that occur in each third historical period is taken as the third number, recorded as N d , then N d It is also a set of time series, specifically expressed as {N d1 , N d2 ,…,N d7}, where N d7 With N m The values are the same.

[0042] Based on the above example, the maximum value is selected from multiple third quantities, which is recorded as N d_max , calculate the average value of multiple second quantities, recorded as N h_ave , given a preset coefficient, assuming it is 1.2, this example is only for example and does not constitute a specific limitation. h_ave The result is recorded as N ′ h_avery , N ′ h_avery It is a dynamic reference threshold.

[0043] When the N of the above type of alarm information m The following conditions are met: N m Greater than N d_max 、N m Greater than the dynamic reference threshold N ′ h_avery, K-means or DBSCAN algorithm can be used to cluster them to form multiple clusters. Each cluster represents a set of alarms with similar characteristics, such as a common geographical location, related network components, etc. The alarm information in each cluster is analyzed and located, and corresponding alarm information is generated based on the clustering and location results.

[0044] As an optional implementation, multiple first alarms within the first historical period are clustered, and the first alarms in each obtained cluster are located. This can be specifically achieved in the following manner: a preset clustering algorithm is used to cluster multiple first alarms within the first historical period from a target dimension to obtain multiple clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; for each cluster, the faulty network element is located based on the similarity between the first alarms in the cluster, wherein the dimension of similarity includes at least one of the following: alarm text similarity, alarm location similarity, and IP similarity.

[0045] During the clustering process, the system analyzes alarm data based on target dimensions, such as location, time, or device type. For example, by analyzing the geographic location of alarms, the system can determine whether these alarms are concentrated in a specific area, thereby identifying possible fault hotspots. By analyzing the distribution of alarm times, the system can determine whether alarms exhibit periodic or time-clustered characteristics, which is crucial for determining whether faults are related to network load during a specific period. By analyzing the device type of alarms, the system can identify which types of devices are issuing alarms more frequently, which may indicate a common problem with the device hardware or software.

[0046] For each cluster, the system further locates the faulty network element based on the similarity between alarms. Similarity can include alarm text similarity, alarm location similarity, and IP similarity. These metrics comprehensively assess the relevance of alarms from different perspectives. Alarm text similarity: By calculating the semantic similarity between alarm texts, the system can identify alarms with identical or similar fault descriptions, which are likely related to the same faulty network element. Alarm location similarity: For alarms with geographic information, the system analyzes the similarity of alarm locations to determine whether the fault is associated with a specific geographic location. For example, in the case of a base station signal anomaly, if alarm locations are highly concentrated, this likely indicates a hardware failure or network configuration issue with the base stations in that area. IP similarity: The system analyzes the similarity of alarm IP addresses to determine whether the alarms were issued by the same network element or group of elements. For network devices, the IP address uniquely identifies them within the network. IP similarity analysis can quickly locate the specific device or group of devices that have a fault.

[0047] Based on the characteristics and positioning results of these clusters, the system will generate a first warning notification, which can record in detail the possible source of the fault, the fault type, and the recommended treatment measures, ensuring that the system can immediately push these warning notifications to relevant operation and maintenance personnel, ensuring that they can take quick action before the problem becomes serious, prevent potential risks, and ensure the stable operation and service quality of the network.

[0048] In the case where the low-level alarm information is caused by user behavior, the time series prediction model can be used to periodically analyze the second alarms in the second database. When the predicted number of second alarms does not match the actual number of second alarms, the second alarms in the second database are analyzed, and a second early warning notification is generated based on the analysis results. This can be achieved in the following way: at each analysis moment, the fourth number of second alarms in the second database in the fourth historical period including the analysis moment, the fifth number of second alarms in multiple consecutive fifth sub-historical periods in the fifth historical period before the fourth historical period, and the sixth number of second alarms in each sixth historical period in multiple consecutive days before the fourth historical period are determined, where , the fifth sub-historical period is the same length as the fourth historical period, and the sixth historical period is the same time as the fourth historical period; the pre-trained first time series prediction model is used to analyze the time series composed of multiple fifth quantities, and the seventh number of second alarms in the predicted fourth historical period is obtained; the pre-trained second time series prediction model is used to analyze the time series composed of multiple sixth quantities, and the eighth number of second alarms in the predicted fourth historical period is obtained; when the fourth number is greater than the maximum value of the seventh number or the eighth number or the sixth number, the multiple second alarms in the fourth historical period are clustered, and the second alarms in each cluster cluster obtained are located; a second early warning notification is generated based on the clustering results and the positioning results.

[0049] Specifically, assuming that the analysis time is 18:00 on the same day, 17:55-18:00 on the same day is taken as the fourth historical period, 17:00-17:55 on the same day is taken as the fifth historical period, and the fifth historical period is divided into 11 fifth sub-historical periods with the length of the fourth historical period, i.e., 5 minutes, as the interval. The 17:55-18:00 period of each day in the past week starting from the day before the analysis time is taken as the sixth historical period. Then, when actually performing statistical analysis on the alarm information, the number of each type of second alarm in the fourth historical period can be taken as the fourth number, recorded as M m , the number of each type of second alarm in each fifth historical sub-period is taken as the fifth number, recorded as M h , the number of each type of second alarm in each sixth historical period is taken as the sixth number, recorded as M d .

[0050] Based on the above example, the number of each type of alarm in the fifth historical period can be expressed as a time series set {M h1 , M h2 ,…,M h11} indicates that by using the pre-trained first time series prediction model to analyze the time series composed of the fifth quantity, the predicted number of the second alarm within 17:55-18:00 (the fourth historical period) can be obtained. The predicted number is used as the seventh number of the second alarm, denoted as M ′ m In the sixth historical period, the number of each type of alarm can be expressed as a time series set {M d1 , M d2 ,…,M d7} indicates that by using the pre-trained second time series prediction model to analyze the time series composed of the sixth quantity, the predicted number of second alarms between 17:55 and 18:00 (the fourth historical period) on the day of analysis can be obtained as the eighth number of the second alarm, denoted as M ′ m ′ .

[0051] For each type of alarm information in the second alarm information, a maximum value is selected from the sixth quantities corresponding to multiple sixth historical periods, and is recorded as M d_max , if the fourth quantity M m Meet any of the following three conditions: M m >M d_max 、M m >M ′ m 、M m >M ′ m ′ , it means that this type of alarm information is abnormal and there may be a potential risk of service quality degradation. It is necessary to perform cluster analysis on the alarm information, locate the second alarm information in each cluster, and generate a second early warning notification based on the cluster analysis and positioning results.

[0052] Since the prediction of the number of alarms serves as the basis for in-depth analysis of the alarms, in order to obtain accurate prediction values, the training of the first time series prediction model and the second time series prediction model is of key significance.

[0053] As an optional implementation, the first time series prediction model and the second time series prediction model can be implemented in the following manner: constructing an initial prediction model, wherein the type of the initial prediction model includes at least one of the following: a long short-term memory network model, a gated recurrent unit, and a Transformer model; obtaining multiple first samples from the second database based on a preset sliding time window, wherein each first sample includes a time series consisting of the ninth number of second alarms in multiple consecutive seventh historical periods, and the sample label of the first sample is the ninth number of second alarms in the next seventh historical period after multiple consecutive seventh historical periods; obtaining multiple second samples from the second database based on a preset periodic time window, wherein each second sample includes a time series consisting of the tenth number of second alarms in each eighth historical period in multiple consecutive days, and the sample label of the second sample is the tenth number of second alarms in the eighth historical period of the next day after multiple consecutive days, and the time of each eighth historical period is the same; using multiple first samples and sample labels to iteratively train the initial prediction model to obtain a first time series prediction model; using multiple second samples and sample labels to iteratively train the initial prediction model to obtain a second time series prediction model.

[0054] In specific implementation, assuming that the preset sliding time window is set to 1 hour, a sample set can be obtained from the second database as the first sample. For a certain sample data, assuming that the sliding time window collects sample data from 17:00 to 18:00 on March 10, 2024, the sample data can be divided into intervals of 5 minutes, so a time series consisting of the ninth number of 11 second alarms can be obtained, and the ninth number of second alarms in the time period from 17:55 to 18:00 on March 10, 2024 can be used as the sample label; similarly, assuming that the preset periodic time window is set to 7 days, a sample set can be obtained from the second database as the second sample. For a certain sample data, assuming that the periodic time window collects sample data from 17:55 to 18:00 every day from March 4, 2024 to March 10, 2024, the tenth number of second alarms in the time period from 17:55 to 18:00 on March 10, 2024 can be used as the sample label.

[0055] The initial model is iteratively trained using the first sample and the corresponding sample label, and the sample label corresponding to the second sample set, respectively, to obtain a first time series prediction model and a second time series prediction model accordingly.

[0056] As an optional implementation method, multiple second alarms within the fourth historical period are clustered, and the second alarms in each obtained cluster are located. This can be specifically achieved in the following way: a preset clustering algorithm is used to cluster multiple second alarms within the fourth historical period from a target dimension to obtain multiple clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; for each cluster, risk network element location is performed based on the similarity between the second alarms in the cluster, wherein the dimension of similarity includes at least one of the following: alarm text similarity, alarm location similarity, and IP similarity.

[0057] Specifically, "risky network elements" refer to network devices or components that may be indirectly affected in the context of abnormal user behavior. When locating risky network elements, the relevant process can be analyzed in an analogous manner to the clustering and locating method of the first alarm information. I will not go into details here. However, in the case of alarms caused by user behavior, we tend to identify risky network elements based on alarm information.

[0058] For example, when a large number of users frequently go online and offline within a specific time period, an alarm may be triggered, which may cause the server or router that was originally working normally to bear additional load and become a potential "risk network element"; user device compatibility issues, such as the poor connection stability of old mobile phones in the 5G network, may trigger an alarm, which may increase the processing burden of the core network element, making it a potential "risk network element."

[0059] In the case where the low-level alarm information is caused by the upgrade of the network management equipment, when the system responds to the user's alarm analysis instruction, it triggers the analysis process for the third alarm, analyzes the third alarm in the third database, and generates a third early warning notification based on the analysis results. This can be achieved in the following way: using a preset clustering algorithm to cluster multiple third alarms in the third database within the ninth historical period including the instruction reception moment from the target dimension to obtain multiple cluster clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; for each cluster cluster, the risk network management device is located based on the similarity between the third alarms in the cluster cluster, wherein the similarity dimension includes at least one of the following: alarm text similarity, alarm location similarity, IP similarity; and a third early warning notification is generated based on the clustering results and the positioning results.

[0060] During analysis, alarm information is first collected and clustered, and then the clustered alarm information is used to locate risky gateway devices based on similarity. The specific analysis and location process is similar to that of the first type of alarm information and will not be repeated here. Common third-level alarms may be alarms caused by user authentication failures due to network management upgrades. Therefore, after the network management equipment is upgraded, only a manual inspection is required. Therefore, the analysis of the third-level alarm can be triggered by the user initiating an alarm analysis command.

[0061] For different types of low-level alarms, corresponding early warning notifications are generated respectively. Specifically, the early warning notifications can be pushed to relevant personnel in a standardized format to ensure the immediate delivery of key information and promote rapid response and problem solving. This can be achieved in the following ways: the target early warning notification is sent to the target object based on a preset notification method, wherein the target early warning notification is the first early warning notification and / or the second early warning notification and / or the third early warning notification; the target early warning notification includes at least one of the following contents generated based on a preset format: alarm clustering results, alarm positioning results, and alarm data curve charts; the preset notification methods include at least one of the following: email notification, SMS notification, and enterprise WeChat notification.

[0062] Specifically, depending on the situation, the first warning notification, the second warning notification, and the third warning notification can be arbitrarily combined as a target warning notification, or each of the three warning notifications can be used as a target warning notification. When the target warning notification is actually sent to the target object, the warning information can be pushed in various preset forms.

[0063] Specifically, when pushing alarm clustering results, the generated alarm clustering results primarily include cluster statistics, detailed descriptions of key alarms, and the confidence score of the clustering algorithm. These clustering results help operations personnel quickly understand the concentration of alarms and determine the nature and scale of the problem. When pushing alarm location results, for each alarm in a cluster, the system provides specific location information for the faulty or risky network element (NE), including device ID, IP address, and geographic coordinates, based on dimensions such as alarm text similarity, alarm location similarity, and IP address similarity. The location results detail the specific location of the problem, facilitating on-site troubleshooting or remote remediation by the operations team. When pushing alarm data graphs, the system generates a time series graph of the alarm data, visually demonstrating the changing trend of alarm frequency over time. The graph may include historical alarm data, real-time alarm data, and predictions from the time series prediction model, providing operations personnel with a visualization tool to help them quickly identify abnormal patterns and predict future trends.

[0064] For the generated target warning notification, the system can select the most appropriate preset notification method from the optional notification methods according to the urgency of the situation and the preset rules. For example, for the first alarm with a higher priority, the system may choose SMS notification and enterprise WeChat notification to ensure an immediate response from the operation and maintenance team; for the second alarm or third alarm that requires in-depth analysis, the system may give priority to email notification and provide a detailed alarm analysis report.

[0065] Through the above steps, the classified storage of low-level alarm information is conducive to providing a basis for adopting different monitoring methods according to different situations, which is convenient for more accurate risk warnings in the later stage; adopting different monitoring methods for different alarm information can effectively ensure the rational use of resources; during detection and analysis, early warning notification information can be generated specifically for different alarm information, and then the early warning notification information can be pushed to the target object in a personalized manner, which can facilitate the target object to quickly understand and identify the potential risks pointed out in the relevant alarm information, and respond in time, thereby solving the technical problem that the relevant alarm management plan focuses on responding to high-level alarms and lacks the analysis and early warning capabilities of low-level alarms.

[0066] Example 2

[0067] According to an embodiment of the present application, a low-level alarm management device for implementing the low-level alarm management method in Example 1 is also provided. Figure 3 As shown, the low-level alarm management device includes at least: a storage module 31, a first warning module 32, a second warning module 33 and a third warning module 34, wherein:

[0068] The storage module 31 may receive an alarm whose alarm level is lower than a preset level, and if the alarm is a first alarm caused by a network element failure, store the first alarm in a first database; if the alarm is a second alarm caused by a user behavior, store the second alarm in a second database; if the alarm is a third alarm caused by a network management device upgrade, store the third alarm in a third database;

[0069] The first warning module 32 can detect the alarm flow written into the first database in real time, analyze the first alarm in the first database when the alarm flow meets the preset trigger condition, and generate a first warning notification based on the analysis result;

[0070] The second warning module 33 may periodically analyze the second alarms in the second database using the time series prediction model, analyze the second alarms in the second database when the predicted number of second alarms does not match the actual number of second alarms, and generate a second warning notification based on the analysis result;

[0071] The third warning module 34 may analyze the third warning in the third database in response to the warning analysis instruction, and generate a third warning notification based on the analysis result.

[0072] The following describes the functions of each module of the low-level alarm management device in conjunction with a specific implementation process.

[0073] In the case where the low-level alarm information is caused by a network element failure, the first early warning module can detect the alarm flow written into the first database in real time, monitor the alarm flow, and when the alarm flow meets the preset conditions, analyze the alarm information in the first database, and generate a first early warning notification based on the analysis results. This can be achieved in the following ways: if the frequency of occurrence of the same type of alarm in the alarm flow exceeds the preset frequency threshold, it is determined that the alarm flow meets the trigger condition; determine the first number of the first alarm in the first database within the first historical period including the trigger moment, and the number of consecutive second sub-historical periods within the second historical period including the trigger moment the second number of first alarms in a plurality of consecutive days including the first historical period, the third number of first alarms in each third historical period within a plurality of consecutive days including the first historical period, wherein the second sub-historical period is the same length as the first historical period, and the third historical period is the same time as the first historical period; determining the maximum value among the multiple third numbers, determining the average value of the multiple second numbers, and determining the product of the average value and a preset coefficient; when the first number is greater than the maximum value or the product, clustering the multiple first alarms in the first historical period, and locating the first alarm in each obtained cluster; generating a first early warning notification based on the clustering result and the positioning result.

[0074] As an optional implementation, the first early warning module clusters multiple first alarms within the first historical period and locates the first alarm in each obtained cluster cluster. This can be specifically achieved in the following manner: using a preset clustering algorithm to cluster multiple first alarms within the first historical period from a target dimension to obtain multiple cluster clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; for each cluster cluster, the faulty network element is located based on the similarity between the first alarms in the cluster cluster, wherein the dimension of similarity includes at least one of the following: alarm text similarity, alarm location similarity, and IP similarity.

[0075] In the case where the low-level alarm information is caused by user behavior, the second early warning module can periodically use the time series prediction model to analyze the second alarms in the second database. When the predicted number of second alarms does not match the actual number of second alarms, the second alarms in the second database are analyzed, and a second early warning notification is generated based on the analysis results. This can be achieved in the following way: at each analysis moment, determine the fourth number of second alarms in the second database in the fourth historical period including the analysis moment, the fifth number of second alarms in multiple consecutive fifth sub-historical periods in the fifth historical period before the fourth historical period, and the sixth number of second alarms in each sixth historical period in multiple consecutive days before the fourth historical period. , wherein the fifth sub-historical period is the same length as the fourth historical period, and the sixth historical period is the same time as the fourth historical period; the pre-trained first time series prediction model is used to analyze the time series composed of multiple fifth quantities, and the seventh number of second alarms in the fourth historical period is predicted; the pre-trained second time series prediction model is used to analyze the time series composed of multiple sixth quantities, and the eighth number of second alarms in the fourth historical period is predicted; when the fourth number is greater than the maximum value of the seventh number or the eighth number or the sixth number, the multiple second alarms in the fourth historical period are clustered, and the second alarms in each cluster cluster obtained are located; and a second early warning notification is generated based on the clustering results and the positioning results.

[0076] As an optional implementation, the first time series prediction model and the second time series prediction model can be implemented in the following manner: constructing an initial prediction model, wherein the type of the initial prediction model includes at least one of the following: a long short-term memory network model, a gated recurrent unit, and a Transformer model; obtaining multiple first samples from the second database based on a preset sliding time window, wherein each first sample includes a time series consisting of the ninth number of second alarms in multiple consecutive seventh historical periods, and the sample label of the first sample is the ninth number of second alarms in the next seventh historical period after multiple consecutive seventh historical periods; obtaining multiple second samples from the second database based on a preset periodic time window, wherein each second sample includes a time series consisting of the tenth number of second alarms in each eighth historical period in multiple consecutive days, and the sample label of the second sample is the tenth number of second alarms in the eighth historical period of the next day after multiple consecutive days, and the time of each eighth historical period is the same; iteratively training the initial prediction model using multiple first samples and sample labels to obtain a first time series prediction model; iteratively training the initial prediction model using multiple second samples and sample labels to obtain a second time series prediction model.

[0077] As an optional implementation method, the second early warning module clusters multiple second alarms within the fourth historical period and locates the second alarms in each obtained cluster cluster. This can be specifically achieved in the following way: using a preset clustering algorithm to cluster multiple second alarms within the fourth historical period from a target dimension to obtain multiple cluster clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; for each cluster cluster, risk network element positioning is performed based on the similarity between the second alarms in the cluster cluster, wherein the dimension of similarity includes at least one of the following: alarm text similarity, alarm location similarity, and IP similarity.

[0078] In the case where the low-level alarm information is caused by the upgrade of the network management equipment, when the third early warning module of the device responds to the user's alarm analysis instruction, it triggers the analysis process for the third alarm, analyzes the third alarm in the third database, and generates a third early warning notification based on the analysis results. This can be achieved in the following way: using a preset clustering algorithm to cluster multiple third alarms in the third database within the ninth historical period including the instruction reception moment from the target dimension to obtain multiple cluster clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; for each cluster cluster, the risk network management device is located based on the similarity between the respective third alarms in the cluster cluster, wherein the dimension of similarity includes at least one of the following: alarm text similarity, alarm location similarity, IP similarity; and a third early warning notification is generated based on the clustering results and the positioning results.

[0079] Optionally, the low-level alarm management device may further include a notification module, which may push corresponding warning notifications to relevant personnel in a standardized format to ensure the immediate delivery of key information and promote rapid response and problem solving. This may be achieved specifically in the following ways: sending the target warning notification to the target object based on a preset notification method, wherein the target warning notification is the first warning notification and / or the second warning notification and / or the third warning notification; the target warning notification includes at least one of the following contents generated based on a preset format: alarm clustering results, alarm positioning results, and alarm data curve graphs; the preset notification methods include at least one of the following: email notification, SMS notification, and enterprise WeChat notification.

[0080] It should be noted that each module in the low-level alarm management device in the embodiment of the present application corresponds one-to-one to each implementation step of the low-level alarm management method in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be elaborated here.

[0081] Example 3

[0082] According to an embodiment of the present application, a computer program product is further provided. The computer program product includes a computer program, wherein when the computer program is executed by a processor, the low-level alarm management method in Example 1 is implemented.

[0083] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the low-level alarm management method in Example 1 by running the computer program.

[0084] According to an embodiment of the present application, a processor is further provided, which is used to run a computer program, wherein the low-level alarm management method in Example 1 is executed when the computer program is run.

[0085] According to an embodiment of the present application, an electronic device is further provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the low-level alarm management method in Example 1 through the computer program.

[0086] Specifically, the computer program executes the following steps when it is running: receiving an alarm with an alarm level lower than a preset level, storing the first alarm in a first database when the alarm is a first alarm caused by a network element failure, storing the second alarm in a second database when the alarm is a second alarm caused by a user behavior, and storing the third alarm in a third database when the alarm is a third alarm caused by an upgrade of a network management device; detecting the alarm stream written into the first database in real time, analyzing the first alarm in the first database when the alarm stream meets the preset triggering condition, and generating a first early warning notification based on the analysis result; periodically analyzing the second alarm in the second database using a time series prediction model, analyzing the second alarm in the second database when the predicted number of second alarms does not match the actual number of second alarms, and generating a second early warning notification based on the analysis result; analyzing the third alarm in the third database in response to the alarm analysis instruction, and generating a third early warning notification based on the analysis result.

[0087] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 4 FIG1 shows a hardware structure block diagram of an electronic device for implementing a low-level alarm management method. Figure 4As shown, the electronic device 40 may include one or more (402a, 402b, ..., 402n are shown in the figure) processors 402 (the processor 402 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 404 for storing data, and a transmission device 406 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 4 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 4 More or fewer components than shown, or with Figure 4 Different configurations shown.

[0088] It should be noted that the one or more processors 402 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry." The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single, independent processing module, or may be incorporated in whole or in part into any of the other components of the electronic device 40. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0089] The memory 404 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the low-level alarm management method in the embodiment of the present application. The processor 402 executes various functional applications and data processing by running the software programs and modules stored in the memory 404, that is, implementing the vulnerability detection method of the above-mentioned application. The memory 404 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 404 may further include a memory remotely located relative to the processor 402, and these remote memories may be connected to the electronic device 40 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0090] Transmission device 406 is used to receive or send data via a network. Specific examples of the aforementioned network may include a wireless network provided by the communications provider of electronic device 40. In one embodiment, transmission device 406 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, transmission device 406 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0091] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 40 .

[0092] The serial numbers of the above embodiments are for description only and do not represent the advantages or disadvantages of the embodiments.

[0093] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0094] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0095] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0096] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0097] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code.

[0098] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A low-level alarm management method, characterized in that: include: receiving an alarm with an alarm level lower than a preset level, and if the alarm is a first alarm caused by a network element failure, storing the first alarm in a first database; if the alarm is a second alarm caused by a user behavior, storing the second alarm in a second database; and if the alarm is a third alarm caused by a network management device upgrade, storing the third alarm in a third database; detecting in real time the alarm stream written into the first database, analyzing the first alarm in the first database when the alarm stream meets a preset trigger condition, and generating a first warning notification based on the analysis result; periodically analyzing the second alarms in the second database using a time series prediction model, and when the predicted number of second alarms does not match the actual number of second alarms, analyzing the second alarms in the second database and generating a second warning notification based on the analysis results; In response to the alarm analysis instruction, the third alarm in the third database is analyzed, and a third early warning notification is generated based on the analysis result.

2. The method according to claim 1, characterized in that When the alarm flow meets a preset trigger condition, analyzing the first alarm in the first database and generating a first warning notification based on the analysis result, including: If the occurrence frequency of the same type of alarms in the alarm stream exceeds a preset frequency threshold, determining that the alarm stream meets the trigger condition; Determining, in the first database, a first number of first alarms within a first historical period that includes a trigger moment, a second number of first alarms within a plurality of consecutive second sub-historical periods within a second historical period that includes the trigger moment, and a third number of first alarms within each of a plurality of consecutive days that include the first historical period, wherein the second sub-historical period is the same length as the first historical period, and the third historical period is the same time as the first historical period; determining a maximum value among a plurality of the third quantities, determining an average value among a plurality of the second quantities, and determining a product of the average value and a preset coefficient; When the first number is greater than the maximum value or the product, clustering the multiple first alarms in the first historical period, and locating the first alarm in each obtained cluster; The first warning notification is generated based on the clustering result and the positioning result.

3. The method according to claim 2, characterized in that Clustering the plurality of first alarms within the first historical period and locating the first alarm in each obtained cluster includes: Clustering the plurality of first alarms within the first historical period based on a target dimension using a preset clustering algorithm to obtain a plurality of cluster clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; For each cluster, the faulty network element is located based on the similarity between the first alarms in the cluster, wherein the dimension of the similarity includes at least one of the following: alarm text similarity, alarm location similarity, and IP similarity.

4. The method according to claim 1, wherein Periodically analyzing the second alarms in the second database using the time series prediction model, analyzing the second alarms in the second database when the predicted number of second alarms does not match the actual number of second alarms, and generating a second warning notification based on the analysis results, including: determining, at each analysis moment, a fourth number of second alarms in the second database within a fourth historical period including the analysis moment, a fifth number of second alarms in a plurality of consecutive fifth sub-historical periods within a fifth historical period preceding the fourth historical period, and a sixth number of second alarms in each of a plurality of consecutive days preceding the fourth historical period, wherein the fifth sub-historical period is the same length as the fourth historical period, and the sixth historical period is the same time as the fourth historical period; Analyzing a time series consisting of a plurality of the fifth quantities using a pre-trained first time series prediction model to obtain a predicted seventh quantity of the second alarm within the fourth historical period; Analyzing a time series consisting of a plurality of the sixth quantities using a pre-trained second time series prediction model to obtain a predicted eighth quantity of the second alarms within the fourth historical period; When the fourth number is greater than a maximum value among the seventh number, the eighth number, or the sixth number, clustering the plurality of second alarms within the fourth historical period, and locating the second alarms in each obtained cluster; The second warning notification is generated based on the clustering result and the positioning result.

5. The method according to claim 4, characterized in that Clustering the plurality of second alarms within the fourth historical period, and locating the second alarm in each obtained cluster, includes: Clustering the plurality of second alarms within the fourth historical period from a target dimension using a preset clustering algorithm to obtain a plurality of cluster clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; For each cluster, risk network element positioning is performed based on the similarity between each second alarm in the cluster, wherein the dimension of the similarity includes at least one of the following: alarm text similarity, alarm location similarity, and IP similarity.

6. The method according to claim 4, characterized in that The training process of the first time series prediction model and the second time series prediction model includes: Constructing an initial prediction model, wherein the type of the initial prediction model includes at least one of the following: a long short-term memory network model, a gated recurrent unit, and a Transformer model; Acquire multiple first samples from the second database based on a preset sliding time window, wherein each first sample includes a time series consisting of the ninth number of second alarms in a plurality of consecutive seventh historical time periods, and a sample label of the first sample is the ninth number of second alarms in a seventh historical time period next after the plurality of consecutive seventh historical time periods; Acquire multiple second samples from the second database based on a preset periodic time window, wherein each second sample includes a time series consisting of the tenth number of second alarms in each eighth historical period over multiple consecutive days, and a sample label of the second sample is the tenth number of second alarms in the eighth historical period of the next day after the multiple consecutive days, where the eighth historical periods are all the same time; Iteratively training the initial prediction model using the plurality of first samples and sample labels to obtain the first time series prediction model; The initial prediction model is iteratively trained using the plurality of second samples and sample labels to obtain the second time series prediction model.

7. The method according to claim 1, characterized in that Analyzing the third alarm in the third database and generating a third warning notification based on the analysis result, including: Clustering the plurality of third alarms in the third database within a ninth historical period including the instruction receiving moment based on a target dimension using a preset clustering algorithm to obtain a plurality of cluster clusters, wherein the target dimension includes at least one of the following: alarm location, alarm time, and alarm device type; For each cluster, locating the risk network management device based on the similarity between each third alarm in the cluster, wherein the dimension of the similarity includes at least one of the following: alarm text similarity, alarm location similarity, and IP similarity; The third warning notification is generated based on the clustering result and the positioning result.

8. The method according to claim 1, characterized in that The method further comprises: The target warning notification is sent to the target object based on a preset notification method, wherein the target warning notification is the first warning notification and / or the second warning notification and / or the third warning notification; the target warning notification includes at least one of the following contents generated based on a preset format: alarm clustering results, alarm positioning results, and alarm data curve charts; the preset notification method includes at least one of the following: email notification, SMS notification, and enterprise WeChat notification.

9. A low-level alarm management device, characterized in that: include: a storage module, configured to receive an alarm whose alarm level is lower than a preset level, and if the alarm is a first alarm caused by a network element failure, store the first alarm in a first database; if the alarm is a second alarm caused by a user behavior, store the second alarm in a second database; and if the alarm is a third alarm caused by a network management device upgrade, store the third alarm in a third database; a first warning module, configured to detect in real time the alarm stream written into the first database, analyze the first alarm in the first database when the alarm stream meets a preset trigger condition, and generate a first warning notification based on the analysis result; a second warning module, configured to periodically analyze the second alarms in the second database using a time series prediction model, and when the predicted number of second alarms does not match the actual number of second alarms, analyze the second alarms in the second database and generate a second warning notification based on the analysis result; The third warning module is configured to analyze the third warning in the third database in response to the warning analysis instruction, and generate a third warning notification based on the analysis result.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the low-level alarm management method according to any one of claims 1 to 8 through the computer program.

Images