Early warning method for operation and maintenance alarm event and related device

Abstract

The invention discloses an early warning method for an operation and maintenance alarm event and a related device, which can be used in the field of artificial intelligence, and the method comprises the following steps: firstly, obtaining current alarm information; then, on the basis of the current alarm information and a pre-established Bayesian network model, predicting an alarm event to be generated and an alarm probability; the Bayesian network model is constructed based on a prior probability calculated by using historical alarm information and a directed incidence relation between alarm events; and finally, based on the alarm event to be generated and the alarm probability, outputting alarm early warning information. Therefore, causal reasoning between the alarm events can be performed through the Bayesian network model constructed by using the prior probability calculated by using the historical alarm information and the directed incidence relation between the alarm events, derivative alarm events are prevented from being identified as effective alarms, the false alarm rate of operation and maintenance alarms is reduced, and the operation and maintenance efficiency is improved. And enough time can be provided for operation and maintenance personnel to intervene, so that stable operation of the application system is ensured.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an early warning method and related device for operation and maintenance alarm events. Background Art

[0002] As the scale of application systems expands and their complexity increases, the average daily alarm volume of the system increases significantly, and the average daily alarm volume of some systems can reach more than 100,000.

[0003] Currently, threshold-based early warning methods are commonly used to trigger operation and maintenance alarms. For example, by monitoring metrics such as CPU utilization and memory usage, operation and maintenance alarms are triggered when the metrics exceed the corresponding fixed thresholds. However, in actual operation and maintenance, a root cause alarm event may trigger multiple derivative alarm events. If warnings are based solely on fixed thresholds, the correlation between alarm events cannot be captured. All derivative alarm events will trigger alarms separately, resulting in a high false alarm rate. This puts operation and maintenance personnel in a difficult position of passively responding to massive alarms, making it impossible to accurately determine the cause of the alarm event. This wastes a large amount of operation and maintenance resources, seriously affecting operation and maintenance efficiency and system stability.

[0004] Therefore, how to reduce the false alarm rate of operation and maintenance alarms has become a problem that needs to be solved. Summary of the Invention

[0005] Based on the above problems, the present application provides an early warning method and related devices for operation and maintenance alarm events, which can reduce the false alarm rate of operation and maintenance alarms.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] In a first aspect, an embodiment of the present application provides an early warning method for an operation and maintenance alarm event, the method comprising:

[0008] Get current alarm information;

[0009] Based on the current alarm information and a pre-established Bayesian network model, predicting an alarm event to occur and the probability of an alarm; the Bayesian network model is constructed based on a priori probabilities calculated using historical alarm information and directed associations between alarm events;

[0010] Based on the alarm event to occur and the alarm probability, alarm warning information is output.

[0011] Optionally, after predicting an alarm event to occur and an alarm probability based on the current alarm information and a pre-established Bayesian network model, the method further includes:

[0012] Calculating the posterior probability of each alarm event based on actual alarm information received after outputting the alarm warning information;

[0013] The Bayesian network model is updated based on the posterior probability; the updated Bayesian network model is used to perform prediction of alarm events to occur and alarm probabilities.

[0014] Optionally, before obtaining the current alarm information, the method further includes:

[0015] Get historical alarm information;

[0016] Based on the historical alarm information, calculating the prior probability of events within the associated time window by statistical methods;

[0017] A Bayesian network model is constructed based on the prior probability and pre-configured expert knowledge.

[0018] Optionally, the calculating, based on the historical alarm information, a priori probability of an event within the associated time window by a statistical method includes:

[0019] Based on the historical alarm information, counting the total number of root cause alarm events occurring within a preset time period in the historical alarm information;

[0020] Based on the total number of occurrences of the root cause alarm event within a preset time period and an associated time window, a priori probability of the derivative alarm event occurring after the root cause alarm event occurs within the associated time window is calculated.

[0021] Optionally, constructing a Bayesian network model based on the prior probability and pre-configured expert knowledge includes:

[0022] Based on pre-configured expert knowledge, modifying the directed association relationship between the prior probability and the alarm event;

[0023] Based on the corrected prior probability and the directed correlation between alarm events, a Bayesian network model is constructed.

[0024] Optionally, before predicting an alarm event to occur and an alarm probability based on the current alarm information and a pre-established Bayesian network model, the method further includes:

[0025] Get real-time alarm frequency;

[0026] Based on the real-time alarm frequency and a preset adjustment threshold, the associated time window of the Bayesian network model is adjusted.

[0027] Optionally, the current alarm information is alarm information of a related alarm event.

[0028] In a second aspect, an embodiment of the present application provides an early warning device for operation and maintenance alarm events, the device comprising:

[0029] Acquisition module, used to obtain current alarm information;

[0030] A prediction module, configured to predict upcoming alarm events and alarm probabilities based on the current alarm information and a pre-established Bayesian network model; the Bayesian network model is constructed based on prior probabilities calculated using historical alarm information and directed associations between alarm events;

[0031] The output module is used to output alarm warning information based on the alarm event to be occurred and the alarm probability.

[0032] In a third aspect, an embodiment of the present application provides an early warning device for operation and maintenance alarm events, the device comprising: a memory and a processor;

[0033] The memory is used to store program code and transmit the program code to the processor;

[0034] The processor is used to execute the steps of the early warning method for operation and maintenance alarm events described in any implementation of the first aspect according to the program code.

[0035] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program runs on an early warning device for an operation and maintenance alarm event, the early warning device for an operation and maintenance alarm event executes the steps of the early warning method for an operation and maintenance alarm event described in any embodiment of the first aspect.

[0036] Compared with the existing technology, this application has the following beneficial effects:

[0037] The embodiment of the present application provides an early warning method for operation and maintenance alarm events, in which, first, current alarm information is obtained; then, based on the current alarm information and a pre-established Bayesian network model, the alarm event to be occurred and the alarm probability are predicted; the Bayesian network model is constructed based on the prior probability calculated using historical alarm information and the directed correlation relationship between the alarm events; finally, based on the alarm event to be occurred and the alarm probability, the alarm warning information is output. Thus, by using the Bayesian network model constructed based on the prior probability calculated using historical alarm information and the directed correlation relationship between the alarm events, causal reasoning between alarm events can be performed, root cause alarm events and derivative alarm events can be distinguished, the dependence on a single indicator can be reduced, and derivative alarm events related to the current alarm information can be warned in advance, thereby avoiding the derivative alarm event being identified as a valid alarm, reducing the false alarm rate of operation and maintenance alarms, and providing sufficient time for operation and maintenance personnel to intervene to ensure the stable operation of the application system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0039] Figure 1 A flowchart of an early warning method for operation and maintenance alarm events provided in an embodiment of the present application;

[0040] Figure 2 A flowchart of another early warning method for operation and maintenance alarm events provided in an embodiment of the present application;

[0041] Figure 3 A schematic diagram of an association time window adjustment process provided in an embodiment of the present application;

[0042] Figure 4 A flow chart of a Bayesian network model training method provided in an embodiment of the present application;

[0043] Figure 5 A schematic diagram of an early warning device for operation and maintenance alarm events provided in an embodiment of the present application;

[0044] Figure 6 A structural diagram of an early warning device for operation and maintenance alarm events provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] The early warning method and related devices for operation and maintenance alarm events provided in this application can be used in the field of artificial intelligence. The above is only an example and does not limit the application field of the early warning method and related devices for operation and maintenance alarm events provided in this application.

[0046] The terms "first", "second", "third" and "fourth" in the specification, claims and drawings of this application are used to distinguish different objects rather than to limit a specific order.

[0047] In the embodiments of this application, words such as "as an example" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described in the embodiments of this application as "as an example" or "for example" should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "as an example" or "for example" is intended to present the relevant concepts in a concrete manner.

[0048] The terms used in the implementation section of this application are only used to explain the specific embodiments of this application and are not intended to limit this application.

[0049] In order to help those skilled in the art better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0050] See also Figure 1 , which is a flow chart of an early warning method for an operation and maintenance alarm event provided by an embodiment of the present application, the method comprising:

[0051] S101: Obtain current alarm information.

[0052] Alarm information is generated by internal or external monitoring software of the system and is used to reflect the operating status or fault conditions of the application system. It may include but is not limited to key information such as the time of occurrence of the alarm event, the name of the device or system where the alarm event occurred, and a description of the fault.

[0053] As an example, current alarm information can be obtained in real time through a monitoring platform such as Prometheus or Zabbix, and data cleaning can be performed on the collected current alarm information to remove invalid, erroneous or irrelevant current alarm information.

[0054] After data cleaning, the current alarm information can be feature-screened using pre-configured expert knowledge. If the current alarm information is related to a related alarm event, steps S102 and S103 are executed. If the current alarm information is related to an independent alarm event, the current alarm information is directly output. Related alarm events include root cause alarm events and derived alarm events.

[0055] Expert knowledge is built based on the experts' deep understanding of system operation and alarm events. By using expert knowledge, it is possible to accurately determine whether the current alarm information belongs to the alarm information of a coherent alarm event, thereby avoiding the Bayesian network model from making invalid predictions for the alarm information of independent alarm events and improving the early warning efficiency of operation and maintenance alarm events.

[0056] S102: Based on the current alarm information and the pre-established Bayesian network model, predict the alarm event to be occurred and the alarm probability.

[0057] The Bayesian network model is constructed based on prior probabilities calculated from historical alarm information and the directed associations between alarm events. Through the Bayesian network, the probabilistic relationships between alarm events can be accurately established and described, making early warnings more precise.

[0058] The Bayesian network itself is a directed acyclic graph (DAG), consisting of nodes (representing alarm events) and directed edges (representing the dependencies between events). Its structure allows the definition of causal direction through the direction of the directed edges, that is, from the cause node to the effect node.

[0059] In the operation and maintenance scenario, if event A triggers event B, this relationship can be represented by a directed edge of "A→B" in the Bayesian network, directly solidifying the directionality of A as cause and B as effect in the structure, forming a directed association relationship.

[0060] By using a Bayesian network model constructed based on the prior probability calculated using historical alarm information and the directed association relationship between alarm events, the root cause alarm event and derivative alarm event associated with the alarm event in the current alarm information can be identified using the directed association relationship, thereby finding the derivative alarm event corresponding to the same root cause alarm event as the current alarm time, or the derivative alarm event with the current alarm event as the root cause alarm event, and using the prior probability to calculate the alarm probability corresponding to each derivative alarm event.

[0061] S103: Outputting alarm warning information based on the alarm event to be occurred and the alarm probability.

[0062] Specifically, alarm warning information can be generated by combining the pending alarm event and the alarm probability corresponding to the pending alarm event. The pending alarm event can be a derivative alarm event corresponding to the same root cause alarm event as the current alarm time, or a derivative alarm event with the current alarm event as the root cause alarm event. The alarm warning information can also include the root cause alarm event corresponding to the current alarm event, facilitating the identification of the root cause of the alarm, allowing operations and maintenance personnel to focus on the root cause and efficiently handle the alarm event.

[0063] In the embodiment of the present application, first, the current alarm information is obtained; then, based on the current alarm information and a pre-established Bayesian network model, the alarm event to be occurred and the alarm probability are predicted; the Bayesian network model is constructed based on the prior probability calculated using historical alarm information and the directed correlation between the alarm events; finally, based on the alarm event to be occurred and the alarm probability, the alarm warning information is output. Thus, by using the Bayesian network model constructed by the prior probability calculated using historical alarm information and the directed correlation between the alarm events, causal reasoning between alarm events can be performed, and the root cause alarm event and the derivative alarm event can be distinguished, thus reducing the dependence on a single indicator, and warning the derivative alarm event related to the current alarm information in advance, thereby avoiding the derivative alarm event being identified as a valid alarm, reducing the false alarm rate of the operation and maintenance alarm, and providing sufficient time for the operation and maintenance personnel to intervene, ensuring the stable operation of the application system.

[0064] See also Figure 2, which is a flow chart of another early warning method for operation and maintenance alarm events provided by an embodiment of the present application, the method comprising:

[0065] S201: Obtain current alarm information and real-time alarm frequency.

[0066] S202: Adjusting the associated time window of the Bayesian network model based on the real-time alarm frequency and a preset adjustment threshold.

[0067] As an example, the initial correlation time window and the adjustment threshold of the correlation time window of the Bayesian network model can be pre-set, and the real-time alarm frequency λ can be monitored. When the real-time alarm frequency λ is greater than or equal to the preset adjustment threshold, the correlation time window can be shortened. Figure 3 As shown, for example, if the initial correlation time window is ten minutes and the adjustment threshold is 1 event / minute, then if the real-time alarm frequency λ ≥ 1 event / minute, the correlation time window can be shortened to five minutes. Thus, after alarm event 1 occurs, the number of alarm events within the correlation time window can be reduced from four events (alarm event 2, alarm event 3, alarm event 4, and alarm event 5) to only two events (alarm event 2 and alarm event 3). The adjustment threshold of the correlation time window can be set using expert knowledge.

[0068] Therefore, by flexibly adjusting the correlation time window according to the real-time alarm frequency, the time range for judging whether there is a correlation between alarm events can be reasonably set. In the case of high-frequency alarms, the correlation time window can be shortened to focus on strong-correlated alarms in a short period of time, avoiding too many redundant alarms from being included in the correlation analysis, and improving the real-time response speed; in the case of low-frequency alarms, the correlation time window can be extended to capture weak-correlated alarms with longer intervals, avoiding missing real correlations due to too short time, improving the accuracy of the correlation judgment between alarm events, and thus improving the accuracy of alarm warning information.

[0069] Optionally, multiple adjustment thresholds can be set to flexibly adjust the correlation time window in a step-by-step manner. For example, the adjustment thresholds can be set to 0.5 times / minute and 1 time / minute, with an initial correlation time window of ten minutes. If the real-time alarm frequency λ ≥ 0.5 times / minute, the correlation time window is shortened to seven minutes. If the real-time alarm frequency is 0.5 times / minute > λ ≥ 1 time / minute, the correlation time window is shortened to five minutes.

[0070] S203: Based on the current alarm information and the pre-established Bayesian network model, predict the alarm event to be occurred and the alarm probability.

[0071] The Bayesian network model is constructed based on the prior probability calculated using historical alarm information and the directed association relationship between alarm events. The prior probability of an alarm event can be calculated based on the historical alarm information within the associated time window.

[0072] S204: Outputting alarm warning information based on the alarm event to be occurred and the alarm probability.

[0073] S205: Calculate the posterior probability of each alarm event based on the actual alarm information received after the alarm warning information is output.

[0074] Specifically, the calculation of the posterior probability is a dynamic update of the prior probability based on the actual alarm information generated after the warning. After each alarm warning information is generated, the system tracks and records the actual occurrence of the alarm event and then incorporates the actual alarm information to recalculate the posterior probability.

[0075] As an example, the posterior probability can be calculated using formula (1):

[0076]

[0077] Where P(B|A) represents the probability of event B occurring when event A occurs; t represents time; A t Indicates whether A occurs at time t. If it occurs, it is 1; if it does not occur, it is 0 and is not counted in the statistics. τ represents the associated time window. sum(A T ) represents the total number of times event A occurs within the time period T; T' represents the interval from the last deadline for calculating the prior probability to the current time for calculating the posterior probability.

[0078] S206: Update the Bayesian network model based on the posterior probability.

[0079] The updated Bayesian network model is used to predict the alarm events to be generated and the probability of the alarm.

[0080] The process of updating the Bayesian network model based on the posterior probability is essentially to superimpose new data on the original prior probability, rather than recalculating based on the full amount of historical data; parameters in the Bayesian network model, such as event association probability, are dynamically adjusted based on the posterior probability feedback, but network structures such as the causal relationship between alarm events do not need to be rebuilt. Therefore, updating the Bayesian network model only with the posterior probability calculated based on new data can not only optimize the model parameters to improve the accuracy of alarm warning information, but also avoid the high computational cost of repeated construction and reduce the cost of model retraining. An initial construction combined with continuous incremental updates enables the Bayesian network model to iterate in real time as new alarm information is generated, avoiding the lag of traditional models that rely on retraining of the full amount of historical data. The model's predictive ability can continue to improve as operation and maintenance data accumulates, thereby achieving efficient and accurate early warning of alarm events.

[0081] See also Figure 4 , which is a flow chart of a Bayesian network model training method provided in an embodiment of the present application, the method comprising:

[0082] S401: Obtain historical alarm information.

[0083] Optionally, data cleaning may be performed on a plurality of alarm information collected over a period of time in the past to remove invalid, erroneous or irrelevant alarm information, thereby retaining valid historical alarm information.

[0084] S402: Based on historical alarm information, calculate the prior probability of events within the associated time window using a statistical method.

[0085] For example, based on historical alarm information, the total number of root cause alarm events that occurred within a preset time period in the historical alarm information can be counted; based on the total number of root cause alarm events that occurred within the preset time period and the associated time window, the prior probability of the occurrence of a derivative alarm event after the root cause alarm event occurred within the associated time window can be calculated.

[0086] Specifically, the root cause alarm event is recorded as event A, and the derivative alarm event is recorded as event B. Then, based on the historical alarm information, the total number of times event A occurs within the preset time period T in the historical alarm information can be counted to obtain sum(A T ); Then, based on sum(A T ) and the associated time window τ, we can calculate the prior probability P(B|A) of event B occurring after event A occurs within the associated time window:

[0087]

[0088] Where, t represents time; A t Indicates whether A occurs at time t. If it occurs, it is 1; if it does not occur, it is 0 and is not counted in the statistics.

[0089] S403: Constructing a Bayesian network model based on prior probabilities and pre-configured expert knowledge.

[0090] As an example, the prior probability and the directed association relationship between the alarm events may be modified based on pre-configured expert knowledge; and then, a Bayesian network model may be constructed based on the modified prior probability and the directed association relationship between the alarm events.

[0091] Specifically, the prior probability is modified based on pre-configured expert knowledge, which may include adjusting the prior probability upward, downward, or to zero.

[0092] For example, if the model calculates through historical alarm information that the prior probability of a transaction failure (event B) occurring after a network fluctuation (event A) is 30%, but experts know that the association probability is actually higher during peak hours on weekdays, the association probability weight between event A and event B during peak hours can be increased, such as adjusting the prior probability to 50%.

[0093] For example, if experts clearly determine that there is no actual causal relationship between printer offline (event C) and server downtime (event D), then even if the two alarm events co-occur accidentally in historical alarm information, the prior probability of event C to event D can be forcibly corrected to 0 to eliminate invalid associations.

[0094] Modifying the directed associations between alarm events based on pre-configured expert knowledge may specifically include optimizing triggering conditions of the directed associations and supplementing undiscovered directed associations.

[0095] For example, a directed association relationship "database connection pool full (event E) → application interface timeout (event F)" has been established in the Bayesian network model. Expert knowledge shows that event F is triggered by event E only when the database connection pool usage rate exceeds 90%. Therefore, a trigger condition "database connection pool usage rate exceeds 90%" can be added to this directed association relationship.

[0096] For example, a newly launched payment module has not yet generated sufficient historical alarm information, but expert knowledge shows that cache failure (event G) will cause payment response delay (event H). In this case, a directed association relationship of "event G→event H" can be established in the Bayesian network model.

[0097] Therefore, based on the experts' empirical knowledge of alarm events, the probability calculation and association rules in the Bayesian network model are adjusted and optimized, so that the model can more accurately capture the correlation between alarm events and thus output alarm warning information more accurately.

[0098] See also Figure 5 , which is a schematic diagram of an early warning device for operation and maintenance alarm events provided by an embodiment of the present application, the device includes:

[0099] Acquisition module 501, used to obtain current alarm information;

[0100] Prediction module 502, for predicting upcoming alarm events and alarm probabilities based on current alarm information and a pre-established Bayesian network model; the Bayesian network model is constructed based on prior probabilities calculated using historical alarm information and directed associations between alarm events;

[0101] The output module 503 is used to output alarm warning information based on the alarm event to be occurred and the alarm probability.

[0102] Therefore, by using the prior probability calculated from historical alarm information and the Bayesian network model constructed by the directed correlation relationship between alarm events, causal reasoning between alarm events can be performed, and the root cause alarm events and derivative alarm events can be distinguished, reducing the dependence on a single indicator. It is possible to issue early warnings for derivative alarm events related to the current alarm information, thereby avoiding the derivative alarm events being identified as valid alarms, reducing the false alarm rate of operation and maintenance alarms, and providing sufficient time for operation and maintenance personnel to intervene to ensure the stable operation of the application system.

[0103] Optionally, another early warning device for operation and maintenance alarm events provided in an embodiment of the present application also includes: an update module; used to calculate the posterior probability of each alarm event based on the actual alarm information received after outputting the alarm warning information; updating the Bayesian network model based on the posterior probability; the updated Bayesian network model is used to perform predictions of alarm events to occur and alarm probabilities.

[0104] Optionally, another early warning device for operation and maintenance alarm events provided in an embodiment of the present application also includes: a history acquisition module, a calculation module and a construction module; wherein the history acquisition module is used to obtain historical alarm information; the calculation module is used to calculate the prior probability of events within the associated time window through statistical methods based on the historical alarm information; the construction module is used to construct a Bayesian network model based on the prior probability and pre-configured expert knowledge.

[0105] Optionally, the calculation module is specifically used to: based on historical alarm information, count the total number of root cause alarm events that occurred in the historical alarm information within a preset time period; based on the total number of root cause alarm events that occurred within the preset time period and the associated time window, calculate the prior probability of the occurrence of a derivative alarm event after the root cause alarm event occurs within the associated time window.

[0106] Optionally, the construction module is specifically used to: modify the prior probability and the directed association relationship between the alarm events based on pre-configured expert knowledge; and construct a Bayesian network model based on the modified prior probability and the directed association relationship between the alarm events.

[0107] Optionally, another early warning device for operation and maintenance alarm events provided in an embodiment of the present application also includes: an adjustment module for obtaining a real-time alarm frequency; and adjusting the associated time window of the Bayesian network model based on the real-time alarm frequency and a preset adjustment threshold.

[0108] See also Figure 6 , this figure is a structural diagram of an early warning device for operation and maintenance alarm events provided in an embodiment of the present application, and the device includes: a memory 601 and a processor 602.

[0109] Memory 601: used to store program codes and transmit the program codes to the processor.

[0110] Processor 602: configured to execute the steps of the above-mentioned early warning method for operation and maintenance alarm events according to the instructions in the program code.

[0111] In addition, the present application also provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on the early warning device of the operation and maintenance alarm event, the early warning device of the operation and maintenance alarm event executes the steps of the above-mentioned early warning method of the operation and maintenance alarm event.

[0112] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and storage medium embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0113] The above is merely one specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for early warning of operation and maintenance alarm events, characterized in that: The method comprises: Get current alarm information; Based on the current alarm information and a pre-established Bayesian network model, predicting an alarm event to occur and the probability of an alarm; the Bayesian network model is constructed based on a priori probabilities calculated using historical alarm information and directed associations between alarm events; Based on the alarm event to occur and the alarm probability, alarm warning information is output.

2. The method according to claim 1, characterized in that After predicting the alarm event to be occurred and the alarm probability based on the current alarm information and the pre-established Bayesian network model, the method further includes: Calculating the posterior probability of each alarm event based on actual alarm information received after outputting the alarm warning information; The Bayesian network model is updated based on the posterior probability; the updated Bayesian network model is used to perform prediction of alarm events to occur and alarm probabilities.

3. The method according to claim 1, characterized in that Before obtaining the current alarm information, the method further includes: Get historical alarm information; Based on the historical alarm information, calculating the prior probability of events within the associated time window by statistical methods; A Bayesian network model is constructed based on the prior probability and pre-configured expert knowledge.

4. The method according to claim 3, characterized in that The calculating, based on the historical alarm information, the prior probability of an event within the associated time window by a statistical method includes: Based on the historical alarm information, counting the total number of root cause alarm events occurring within a preset time period in the historical alarm information; Based on the total number of occurrences of the root cause alarm event within a preset time period and an associated time window, a priori probability of the derivative alarm event occurring after the root cause alarm event occurs within the associated time window is calculated.

5. The method according to claim 3, characterized in that The constructing of a Bayesian network model based on the prior probability and pre-configured expert knowledge includes: Based on pre-configured expert knowledge, modifying the directed association relationship between the prior probability and the alarm event; Based on the corrected prior probability and the directed correlation between alarm events, a Bayesian network model is constructed.

6. The method according to claim 1, characterized in that Before predicting the alarm event to be occurred and the alarm probability based on the current alarm information and the pre-established Bayesian network model, the method further includes: Get real-time alarm frequency; Based on the real-time alarm frequency and a preset adjustment threshold, the associated time window of the Bayesian network model is adjusted.

7. The method according to claim 1, characterized in that The current alarm information is the alarm information of the relevant alarm event.

8. An early warning device for operation and maintenance alarm events, characterized in that: The device comprises: Acquisition module, used to obtain current alarm information; A prediction module, configured to predict upcoming alarm events and alarm probabilities based on the current alarm information and a pre-established Bayesian network model; the Bayesian network model is constructed based on prior probabilities calculated using historical alarm information and directed associations between alarm events; The output module is used to output alarm warning information based on the alarm event to be occurred and the alarm probability.

9. An early warning device for operation and maintenance alarm events, characterized in that: The device includes: a memory and a processor; The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the steps of the early warning method for operation and maintenance alarm events according to any one of claims 1 to 7 according to the program code.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program. When the computer program runs on the early warning device for operation and maintenance alarm events, the early warning device for operation and maintenance alarm events executes the steps of the early warning method for operation and maintenance alarm events according to any one of claims 1 to 7.

Images