Intelligent alarm analysis and diagnosis method and device based on AI algorithm

Abstract

The invention provides an intelligent alarm analysis and diagnosis method and device based on an AI algorithm, and the method comprises the steps: obtaining historical alarm data, and generating an intelligent alarm analysis and diagnosis large model according to the historical alarm data and historical disposal data; acquiring all real-time alarm data in a preset time window, inputting all the real-time alarm data into the intelligent alarm analysis and diagnosis large model, and associating all the real-time alarm data into a plurality of combined alarm records through an alarm association engine, according to the type confidence degree distribution of each combined alarm record by the trend classification model and the component probability distribution of each combined alarm record by the component positioning model, the fault type and the specific fault position are obtained; and generating an alarm disposal suggestion for each combined alarm record according to the fault type and the specific fault position by the matching disposal rule, and then distributing the alarm disposal suggestion. According to the invention, the problems of difficult alarm problem tracing, difficult problem root cause positioning and long fault recovery time are solved.

Description

Technical Field

[0001] The present invention relates to the field of software processing technology, and in particular to an intelligent alarm analysis and diagnosis method and device based on an AI algorithm. Background Art

[0002] Existing alarm analysis and diagnosis technologies include:

[0003] 1. Alarm Triggering: During system and application operation, abnormal performance indicators and logs may occur. Operating systems and applications provide various performance counters to measure system performance indicators. For example, in the Windows operating system, performance monitors can be used to view indicators such as CPU usage, memory usage, and disk I / O. These counter values ​​are regularly collected and compared with preset thresholds. When an indicator exceeds the normal range, an alarm is triggered.

[0004] 2. Alarm Analysis: Manually collect alarm data, including the alarm source system, timestamp, alarm level, and related device or service information. This data is then integrated, such as system logs, performance metrics, and network traffic data. For example, when a server performance alarm is received, performance data such as CPU usage, memory usage, and disk I / O are collected, along with the server's system logs, to aid analysis. Manually create charts to display alarm data and performance metric trends. Regularly generate alarm problem analysis reports, summarizing alarm types, frequency, and resolution status, to provide a reference for subsequent fault prevention and system optimization.

[0005] However, the above alarm analysis and diagnosis technology has the following shortcomings:

[0006] Traditional monitoring alerts come from numerous sources and a wide variety of fault types, making it difficult for operations engineers to quickly locate and troubleshoot the root cause. Furthermore, within the complex IT system architecture, a system failure requires multiple operations engineers to spend a significant amount of time troubleshooting the issue. Each minor issue can potentially lead to a cascading failure, and the time required to resolve the issue simply cannot meet the operational needs of the business environment. Summary of the Invention

[0007] In order to solve the above-mentioned problems in the prior art, the present invention provides an intelligent alarm analysis and diagnosis method and device based on AI algorithm, which solves the problems of difficulty in tracing the source of alarm problems, difficulty in locating the root cause of problems, and time-consuming fault recovery.

[0008] In order to achieve the above object, the technical solution adopted by the present invention is:

[0009] In a first aspect, the present invention provides an intelligent alarm analysis and diagnosis method based on an AI algorithm, comprising the steps of:

[0010] Acquire historical alarm data, train and generate a trend classification model and an alarm correlation engine based on the historical alarm data, train and generate matching and disposal rules based on the historical disposal data of the historical alarm data, establish a component positioning model based on the CMDB asset topology association relationship, and combine the trend classification model, the alarm correlation engine, the component positioning model, and the matching and disposal rules to generate a large model for intelligent alarm analysis and diagnosis;

[0011] Acquire all real-time alarm data within a preset time window, input all real-time alarm data into the intelligent alarm analysis and diagnosis model, associate all real-time alarm data into multiple combined alarm records through the alarm association engine, obtain the fault type of each combined alarm record based on the type confidence distribution of each combined alarm record by the trend classification model and the component probability distribution of each combined alarm record by the component positioning model, obtain the specific fault location based on the component probability distribution, and generate an alarm handling suggestion for each combined alarm record based on the fault type and the specific fault location by the matching handling rule;

[0012] Each combined alarm record is distributed based on the fault type, and an alarm handling suggestion is sent.

[0013] The beneficial effect of the present invention is that when multiple alarms occur, all real-time alarm data are associated into combined alarm records through the alarm correlation engine, reducing the number of fault alarms that need to be processed. The combined alarm records are then intelligently analyzed to determine the alarm type, judge the root cause of the problem, and recommend solutions, thereby achieving the technical effects of improving operation and maintenance efficiency, improving processing accuracy, improving processing timeliness, and realizing accurate fault location, and solving the problems of difficulty in tracing the alarm problem, difficulty in locating the root cause of the problem, and time-consuming fault recovery.

[0014] Optionally, the training and generating of the trend classification model based on the historical alarm data includes the steps of:

[0015] The historical alarm data is normalized in time series, dynamic features are extracted from the normalized historical alarm data, the dynamic features are rolled out through time series statistics, the dynamic features are input into a pre-built trend classification model for training, and finally a trend classification model is generated.

[0016] Optionally, training and generating an alarm correlation engine based on the historical alarm data includes the following steps:

[0017] Performing static rule association on the historical alarm data based on the equipment, time and monitoring indicators in the historical alarm data;

[0018] Performing dynamic correlation mining on the alarm type, device, time, and monitoring indicators in the historical alarm data through machine learning;

[0019] An alarm correlation engine is formed based on the associated static rules and the mined dynamic correlations.

[0020] Optionally, obtaining the fault type of each combined alarm record according to the type confidence distribution of each combined alarm record by the trend classification model and the component probability distribution of each combined alarm record by the component positioning model includes:

[0021] For each combined alarm record, obtain the numerical features corresponding to the monitoring indicator, the text features corresponding to the alarm information, and the topological features obtained based on the CMDB asset topology association relationship according to the main alarm record in the combined alarm record;

[0022] Inputting the numerical features and the text features into the trend classification model to obtain a type confidence distribution, and inputting the topological features into the component positioning model to obtain a component probability distribution;

[0023] The type confidence distribution and the component probability distribution are integrated to construct an association matrix between fault types and components, and a final confidence of each fault type is obtained. The fault type with the highest final confidence is used as the fault type of the combined alarm record.

[0024] Optionally, the method further comprises the steps of:

[0025] Generate a service dependency tree based on the CMDB asset topology relationship, generate an SLO evaluation formula based on the definition of SLO / SLI service levels in SRE operation and maintenance, and build an SLO health evaluation model based on the service dependency tree and the SLO evaluation formula;

[0026] The step of obtaining the specific fault location through the component probability distribution further includes:

[0027] The number of affected business units of the combined alarm record is calculated through the service dependency tree in the SLO health assessment model to obtain the impact range coefficient, and the SLO deviation of the combined alarm record is calculated and obtained through the SLO assessment formula in the SLO health assessment model. The priority score is obtained according to the impact range coefficient, the SLO deviation and the business weight in the combined alarm record, and the priority order of the combined alarm record is determined according to the priority score.

[0028] As described above, we can combine SRE operation and maintenance monitoring indicators with intelligent alarm analysis technology, and implement an elastic threshold adjustment algorithm based on the SLO achievement rate to implement alarm priority diagnosis.

[0029] Optionally, the method further comprises the steps of:

[0030] Prometheus is used to monitor and collect data, trigger and generate real-time alarm data, and receive the real-time alarm data through the Webhook interface of Alertmanager for storage.

[0031] Optionally, the alarm data of the historical alarm data and the real-time alarm data include alarm information and context information, the alarm information is stored in a core alarm table, the context information is stored in a historical alarm table, a system status information table and a device information table, the core alarm table is associated with the historical alarm table and the system status information table by a foreign key through an alarm unique identifier, and the core alarm table is associated with the device information table by a device unique identifier;

[0032] The historical alarm table is used to record alarm status change information, and the system status information table is used to record monitoring indicator information when the alarm status changes.

[0033] As can be seen from the above description, the resource topology relationship and logical association relationship of the alarm information are established through the context information to meet the needs of various types of alarm analysis.

[0034] Optionally, the method further comprises the steps of:

[0035] The execution status of the alarm handling suggestions by the alarm handling personnel and the final processing results are recorded, and the execution status and the executed processing results are fed back to the intelligent alarm analysis and diagnosis model for model optimization and training.

[0036] Optionally, the method further comprises the steps of:

[0037] Model and build critical infrastructure using digital twin technology to obtain a three-dimensional monitoring model that corresponds one-to-one with the critical infrastructure;

[0038] Each combined alarm record is displayed on the three-dimensional monitoring model according to the specific fault location of each combined alarm record.

[0039] In a second aspect, the present invention provides an intelligent alarm analysis and diagnosis device based on an AI algorithm, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the intelligent alarm analysis and diagnosis method based on the AI ​​algorithm of the first aspect when executing the computer program.

[0040] Among them, the technical effects corresponding to the intelligent alarm analysis and diagnosis device based on AI algorithm provided by the second aspect refer to the relevant description of the intelligent alarm analysis and diagnosis method based on AI algorithm provided by the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 Schematic diagram of the main process of the intelligent alarm analysis and diagnosis method based on AI algorithm according to an embodiment of the present invention;

[0042] Figure 2 Schematic diagram of the application of the intelligent alarm analysis and diagnosis method based on the AI ​​algorithm in an actual scenario according to an embodiment of the present invention;

[0043] Figure 3 A line chart of a monthly visual analysis report according to an embodiment of the present invention;

[0044] Figure 4 A schematic diagram of a three-dimensional monitoring model according to an embodiment of the present invention;

[0045] Figure 5 This is a structural diagram of an intelligent alarm analysis and diagnosis device based on AI algorithm according to an embodiment of the present invention.

[0046] Description of reference numerals:

[0047] 1. Intelligent alarm analysis and diagnosis device based on AI algorithm;

[0048] 2. Processor;

[0049] 3. Memory. DETAILED DESCRIPTION

[0050] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. Instead, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0051] Example 1

[0052] Please refer to Figures 1 to 4 , an intelligent alarm analysis and diagnosis method based on AI algorithm, including the following steps:

[0053] S1. Obtain historical alarm data, train and generate a trend classification model and alarm association engine based on the historical alarm data, train and generate matching and disposal rules based on the historical disposal data of the historical alarm data, establish a component positioning model based on the CMDB asset topology association relationship, and combine the trend classification model, alarm association engine, component positioning model and matching and disposal rules to generate a large model for intelligent alarm analysis and diagnosis.

[0054] In this embodiment, different alarm data needs to be correlated to determine whether they belong to the same or related issues, so that these alarms can be combined for analysis. For example, a server's CPU (Central Processing Unit) alarm and memory alarm may be caused by running a memory leaking application at the same time. By setting correlation rules, the CPU alarm and memory alarm can be combined for analysis.

[0055] This embodiment combines time series analysis, statistical correlation, and machine learning to build a closed-loop intelligent alarm analysis system. Therefore, the training and generation of trend classification models and alarm correlation engines based on historical alarm data in step S1 above includes the following steps:

[0056] S11. Standardize the historical alarm data into time series, extract dynamic features from the standardized historical alarm data, roll statistics of dynamic features through time series, input the dynamic features into a pre-built trend classification model for training, and finally generate a trend classification model.

[0057] Among them, step S11 can be specifically divided into:

[0058] a. Time series standardization:

[0059] Resample the original monitoring data of historical alarm data, such as CPU and memory, at fixed intervals of 5 minutes, 10 minutes, and 15 minutes, and use linear interpolation or forward filling to handle missing values.

[0060] b. Dynamic trend feature extraction:

[0061] b1. Comparison of historical values: Calculate the year-on-year or month-on-month change rate Δ_value using the following formula:

[0062] Δ_value=(current_value-prev_value) / prev_value

[0063] Among them, current_value is the current value and prev_value is the previous value.

[0064] b2.Interval trend analysis:

[0065] b21. Sliding Window Statistics: Real-time calculation of statistical features of time series data such as CPU usage within a fixed time window, such as mean, variance, maximum value, etc., to identify short-term fluctuations and long-term trends.

[0066] b22. Trend Slope Calculation: Quantifies the direction and strength of a time series trend. For example, to determine whether CPU usage is continuously increasing or decreasing, the former is represented by a positive slope, while the latter is represented by a negative slope. Linear regression is performed on the data points within each window.

[0067] b23. Mutation point detection: Using the Cusum algorithm, the cumulative deviation between the observed value and the expected value is calculated. When the cumulative deviation exceeds the preset threshold, it is marked as a mutation point. This is used to detect sudden changes in time series, such as a sudden increase in CPU usage from 60% to 90%, and is used to identify abnormal events.

[0068] Among them, the CUSUM algorithm (Cumulative Sum Algorithm) is a statistical method used to monitor process stability. It detects changes in the process by calculating the cumulative sum and provides a means to quickly respond to abnormal situations.

[0069] c. Dynamic trend analysis mechanism: Through the rolling statistical characteristics of time series, unsupervised clustering and supervised classification methods are used to build a trend classification model, and the trend is associated with the alarm rule library.

[0070] Therefore, this embodiment constructs a trend classification model, which is trained by historical alarm data in the historical database and generates the final trend classification model.

[0071] S12. Perform static rule association on the historical alarm data based on the equipment, time, and monitoring indicators in the historical alarm data.

[0072] For example, if the CPU usage exceeds 90% and the memory usage exceeds 80% on the same device within 5 minutes, the system will generate a related alarm if the conditions are met, indicating that the device may have a complex resource bottleneck. The specific code example is as follows:

[0073] #The same device triggers CPU>90% and memory>80% within 5 minutes

[0074] if(alarm1.metric=='CPU'and alarm1.value>90)

[0075] and(alarm2.metric=='MEM'and alarm2.value>80)

[0076] and(alarm1.device==alarm2.device)

[0077] and(abs(alarm1.time-alarm2.time)<300):

[0078] generate_correlated_alert('R001')

[0079] S13. Use machine learning to dynamically mine the associations between alarm types, devices, time, and monitoring indicators in historical alarm data.

[0080] A correlation graph is constructed based on alarm type, device, and monitoring indicators. Frequent item set mining is used to identify commonly co-occurring alarm combinations, such as the frequent simultaneous occurrence of the high-frequency alarm combination "CPU threshold exceeding, memory leak, and disk I / O delay." This assists in the construction of association rules. For example, if alarm A occurs, there is an 80% probability that alarm B will be triggered within 5 minutes, indicating that alarms A and B are related.

[0081] S14. An alarm correlation engine is formed based on the correlated static rules and the mined dynamic correlations.

[0082] In combination with the above, this embodiment regularly retrains the trend analysis model in an incremental learning manner, optimizes the association rule weights based on the latest alarm processing feedback, and finally updates the model training data in reverse by marking false positives / missing negatives through operation and maintenance personnel.

[0083] S15. Generate a service dependency tree based on the CMDB asset topology relationship, generate an SLO evaluation formula based on the definition of SLO / SLI service levels in SRE operations and maintenance, and build an SLO health assessment model based on the service dependency tree and SLO evaluation formula.

[0084] Among them, CMDB asset topology association is the process of organizing and recording different IT assets such as servers, network devices, software applications and the relationships between them in the Configuration Management Database (CMDB).

[0085] Among them, the SLO evaluation formula can be:

[0086] SLO_Score=∑(wi*(1-SLIi / SLOi))

[0087] Here, SLO_Score is the SLO deviation, wi is the metric weight, such as latency 40%, error rate 35%, and throughput 25%. SLIi is the actual measured service level metric, and SLOi is the preset target value. For example, if the API gateway SLOi requires latency < 200ms, and the detected P99 is 350ms, the score for this item is 0.4 * (1-350 / 200) = -0.3.

[0088] S16. Generate matching processing rules based on historical processing data training of historical alarm data.

[0089] In the historical database, different historical alarm data contain records of manual processing, including successful or unsuccessful ones. These data are used to train the most appropriate processing rules for each alarm.

[0090] S17. Establish a component positioning model based on the CMDB asset topology relationship.

[0091] Among them, based on the CMDB asset topology association relationship, the specific faulty component or module can be further located according to the input alarm data.

[0092] S18. Combine the trend classification model, alarm correlation engine, component positioning model, and matching disposal rules to generate an intelligent alarm analysis and diagnosis model.

[0093] Therefore, the above models are combined to form a large intelligent alarm analysis and diagnosis model, such as the one in this embodiment. Figure 2 The following figure shows an AI assistant.

[0094] S2. Obtain all real-time alarm data within a preset time window, input all real-time alarm data into the intelligent alarm analysis and diagnosis model, and associate all real-time alarm data into multiple combined alarm records through the alarm correlation engine. The fault type of each combined alarm record is obtained based on the type confidence distribution of each combined alarm record by the trend classification model and the component probability distribution of each combined alarm record by the component positioning model. The specific fault location is obtained through the component probability distribution, and the matching disposal rules generate alarm disposal suggestions for each combined alarm record based on the fault type and specific fault location.

[0095] In this embodiment, step S2 includes the following steps:

[0096] S21. Monitor and collect data through Prometheus, trigger and generate real-time alarm data, and receive real-time alarm data through the Webhook interface of Alertmanager for storage.

[0097] This example utilizes Prometheus and Alertmanager to build the core of the alert infrastructure. The alert service generates alert configurations for all platform alert rules and sends them to the core Prometheus server, where configuration files are written. The Prometheus configuration is then hot-updated for validation. Prometheus monitors and collects data, triggers alerts, and reports the alert data to the alert service for data storage via Alertmanage's webhook.

[0098] Prometheus is an open-source monitoring system that collects and stores time-series data. AlertManager is a component in the Prometheus ecosystem that handles alert notifications sent by Prometheus.

[0099] After collecting alarm data from various scenarios, such as indicator alarms and log alarms, we collect the resource topology and logical relationships associated with each type of alarm to meet the needs of various alarm analysis. This data is then preprocessed and cleaned, and rule matching is used to deduplicate and reduce noise in the alarms to improve data quality. For example, CPU alarm thresholds are normalized to convert CPU threshold ranges that vary due to factors such as hardware and system configuration into a standard, unified range. CMDB asset topology relationships are used to perform preliminary correlation of alarms, facilitating subsequent root cause identification.

[0100] The historical alarm data can be the real-time alarm data collected in step S21 of this embodiment. After the real-time alarm data is analyzed and processed, it becomes historical alarm data. It can also be alarm data stored by other means of collection in the past. In other words, any data related to alarms can be used as historical alarm data for training.

[0101] Historical and real-time alarm data includes alarm information and context information. Alarm information is stored in the core alarm table, while context information is stored in the historical alarm table, the system status information table, and the device information table. The core alarm table is linked to the historical alarm table and the system status information table via foreign keys using the alarm unique identifier. The core alarm table is linked to the device information table via foreign keys using the device unique identifier. The historical alarm table records alarm status changes, while the system status information table records monitoring indicator information when the alarm status changes.

[0102] This embodiment designs an alarm data storage structure by creating a core alarm table containing fields such as the alarm unique identifier, alarm trigger time, alarm severity, alarm source device ID, and alarm description. Contextual information is stored by associating it with other tables, such as the historical alarm table and the system status information table. The following is an example of contextual information association design for the alarm data storage structure, implementing hierarchical data management through foreign key associations:

[0103] a. Core alarm table (Alarm): stores the core information of the alarm and serves as the associated central table.

[0104] Table 1. Core alarm table

[0105]

[0106] b. Historical alarm table (AlarmHistory): stores alarm status change information and is bound to the alarm table through the alarm_id foreign key. One alarm can correspond to multiple historical status records. This is based on the previous and next associations based on the same alarm unique identifier. For example, under the association of the same alarm unique identifier, there are multiple historical alarm tables. The status update time is in the order of triggering, confirming, and resolving.

[0107] Table 2. Historical alarm table

[0108]

[0109] c. System Status Information Table (SystemStatus): stores monitoring indicator information when the alarm status changes. It is bound to the alarm table through the alarm_id foreign key. Each system status record corresponds to the context of a specific alarm. That is, every time the alarm status changes, there is real-time monitoring indicator information at the time of the current status change. These monitoring indicator information reflects the status changes of this alarm unique identifier after different treatments are performed to determine whether the current treatment has been successfully achieved.

[0110] Table 3. System status information table

[0111]

[0112] d. Device information table (Device): Expands the detailed information of the alarm source. The source_device field of the alarm table is used as a foreign key to relate to the primary key of this table to clarify the key device information of the alarm source.

[0113] Table 4. Device information table

[0114]

[0115] The above data relationship is shown as follows:

[0116] Alarm

[0117] -alarm_id (primary key)

[0118] -source_device->Device.device_id (foreign key)

[0119] -AlarmHistory(1:N)

[0120] -alarm_id->Alarm.alarm_id (foreign key)

[0121] -SystemStatus (1:1 or 1:N)

[0122] -alarm_id->Alarm.alarm_id (foreign key)

[0123] In actual scenarios, when an alarm is triggered:

[0124] Insert into the Alarm table: record the emergency alarm triggered by device A;

[0125] Insert data into the SystemStatus table and save a snapshot of device A's CPU peak at 90% and memory usage at 80%.

[0126] Insert into AlarmHistory table: Initial status is marked as "New Trigger".

[0127] S22. Acquire all real-time alarm data within a preset time window, and input all real-time alarm data into the intelligent alarm analysis and diagnosis model.

[0128] In this embodiment, the preset time window may be 5 minutes, 10 minutes, or 15 minutes, etc.

[0129] S23. All real-time alarm data are correlated into multiple combined alarm records through the alarm correlation engine.

[0130] In complex enterprise-level IT architectures, a single failure may trigger different types of alarms at different times, or trigger alarms across multiple systems. Intelligent analysis can identify commonalities and correlate alarms with similar characteristics, effectively reducing the number of alarms that need to be processed.

[0131] S24. For each combined alarm record, obtain, according to the main alarm record in the combined alarm record, the numerical features corresponding to the monitoring indicator, the text features corresponding to the alarm information, and the topological features obtained based on the CMDB asset topology association relationship.

[0132] This embodiment uses multi-source feature fusion for analysis and processing. Specifically, numerical features are extracted from raw monitoring indicators through sliding window statistics and dynamic normalization. Text features are extracted from log / alarm messages through BERT (Bidirectional Encoder Representations from Transformers, a pre-trained language representation model based on the Transformer model) embedding and keyword extraction. Topological features are extracted from CMDB asset topological relationships through graph embedding and hierarchical encoding.

[0133] S25. Input the numerical features and text features into the trend classification model to obtain the type confidence distribution, and input the topological features into the component positioning model to obtain the component probability distribution.

[0134] The trend classification model determines the confidence distribution of each combined alarm record, indicating whether it belongs to a hardware fault, software fault, network fault, or configuration error fault type (i.e., the type confidence distribution). For example, a combined alarm record might simultaneously include: 68% hardware fault, 20% network fault, 9% software fault, and 3% unobserved faults. The component localization model further outputs the anomaly probability of each component. For example, if a 65% probability of a router port anomaly and a 35% probability of a link aggregation fault are detected simultaneously (i.e., a 65% probability for 'Router:Port-ETH1 / 0 / 3' and a 35% probability for 'Link:Core-Agg'), then both the network fault and hardware fault hypotheses may be supported. This requires cross-validation with the type confidence distribution.

[0135] S26. Fusion the type confidence distribution and component probability distribution to construct a correlation matrix between fault types and components, obtain the final confidence of each fault type, and use the fault type with the highest final confidence as the fault type of the combined alarm record.

[0136] The type confidence distribution records the confidence distribution of the fault type. By constructing an association matrix between the fault type and the component, the component probability distribution of the component location model is combined to obtain the final fault type. In this embodiment, the code example of the fusion process of the two is as follows:

[0137] Example: Fusion of classification and positioning results (normalized to two decimal places)

[0138] from pyds import MassFunction

[0139] #Type confidence distribution (hardware failure 68%, network failure 20%, software failure 9%, unobserved category 3%)

[0140] m1=MassFunction({'hardware':0.68,'network':0.20,'software':0.09,'unknown':0.03})

[0141] #Component probability distribution (router port failure probability 65%, link aggregation failure probability 35%)

[0142] m2=MassFunction({'router':0.65,'link':0.35})

[0143] #Combination rules

[0144] print(f"Final confidence of hardware failure: {0.70:.4f}")#Output: 0.70

[0145] print(f"Network failure final confidence: {0.11:.4f}")#Output: 0.11

[0146] print(f"Final confidence level of software failure: {0.14:.4f}")#Output: 0.14

[0147] print(f"Final confidence of unobserved category:{0.05:.4f}")#Output: 0.05

[0148] Therefore, the fault type of the combined alarm record finally obtained in the preceding code example is hardware fault, and the specific fault location is Router:Port-ETH1 / 0 / 3.

[0149] That is, when multiple alarm data appear, after determining the type confidence distribution and component probability distribution of the combined alarm record, the fault type is determined by the final confidence obtained by the fusion of the type confidence distribution and the component probability distribution. The highest probability in the component probability distribution is used as the specific fault location, and it is possible to determine which alarm is the root cause and which are derived secondary alarms, forming a main alarm record and associated alarm records belonging to the main alarm record. After the main alarm record is successfully handled, the associated alarm records are naturally eliminated because the root cause has been eliminated.

[0150] S27. Calculate the number of affected business units of the combined alarm record through the service dependency tree in the SLO health assessment model to obtain the impact range coefficient, calculate and obtain the SLO deviation of the combined alarm record through the SLO assessment formula in the SLO health assessment model, obtain the priority score based on the impact range coefficient, SLO deviation and the business weight in the combined alarm record, and determine the priority order of the combined alarm record based on the priority score.

[0151] In this embodiment, a multi-dimensional weighted scoring method is used to calculate the priority score, i.e., priority score = business weight * SLO deviation * impact range coefficient. The business weight can be set based on the importance and impact range of each business to determine a weight value for prioritization.

[0152] S28. Generate an alarm handling suggestion for each combined alarm record based on the fault type and specific fault location according to the matching handling rules.

[0153] Therefore, this embodiment matches alarm features, combines them with the CMDB-associated asset topology to create a knowledge graph, and uses historical action data to implement AI-assisted decision-making and generate corresponding alarm action recommendations. Furthermore, it combines SRE operations monitoring metrics with intelligent alarm analysis technology, and implements an elastic threshold adjustment algorithm based on SLO achievement rates to implement alarm priority diagnosis.

[0154] like Figure 2 As shown in Figure 1, alert handling recommendations can include specific steps, such as restarting a service, replacing hardware, adjusting network configuration, performing data recovery, and more, along with the priority and sequence of these actions. Recommendations can also include methods for further troubleshooting and verifying the fault to ensure the effectiveness of the handling measures.

[0155] S3. Distribute each combined alarm record based on the fault type and send alarm handling suggestions.

[0156] In this embodiment, different alarm handlers can handle different fault types. When existing technologies cannot distinguish fault types, only manual judgment is made about which alarm handler is most suitable for handling the current alarm. However, this embodiment not only associates and combines all alarm data but also derives the fault type. This allows for the distribution of combined alarm records based on different fault types, ensuring that alarm records are handled by more professional alarm handlers.

[0157] S4. Record the execution of the alarm handling suggestions by the alarm handling personnel and the final processing results, and feed the executed processing results back to the intelligent alarm analysis and diagnosis model for model optimization and training.

[0158] In this embodiment, if a certain type of alarm is successfully resolved according to the alarm handling suggestions of the large model, the system will strengthen the learning of the alarm processing mode of this type; if the alarm handling suggestions are invalid, the reasons will be analyzed and the model parameters or feature engineering will be adjusted to improve the accuracy and practicality of the large model.

[0159] like Figure 3 Based on the above analysis results, the AI ​​assistant will push monthly visual analysis reports. For example, a topology diagram will be used to show the location and correlation of network device alarms, and a line chart will be used to illustrate the changing trends of performance indicators. Analysis reports will be generated regularly, summarizing alarm problem analysis reports such as alarm type, frequency, and resolution, providing reference for subsequent fault prevention and system optimization.

[0160] S5. Model and build critical infrastructure based on digital twin technology to obtain a three-dimensional monitoring model that corresponds one-to-one with the critical infrastructure.

[0161] S6. Display each combined alarm record on the three-dimensional monitoring model according to the specific fault location of each combined alarm record.

[0162] like Figure 4 As shown, digital twin technology is used to build a 1:1 model of key infrastructure, and 3D computer room alarm visualization allows operation and maintenance personnel to intuitively view the current alarm status and alarm level of the entire data center.

[0163] In summary, the three problems of existing alarm diagnosis relying on manual data analysis, existing alarm analysis being simplistic and disorganized due to omissions, and existing alarm analysis being stagnant at the business level are addressed. The present invention adopts an overall dynamic trend analysis + correlation analysis method to dynamically analyze the historical moment values, interval trend values, and correlation relationships of monitoring indicators to form a fixed analysis mechanism, which makes up for the shortcomings of the existing disorganized analysis. At the same time, intelligent alarm analysis technology can determine the root cause of the problem, thereby locating the specific fault location, and display the location and correlation of equipment alarms in the form of a topology map, which can be traced from the business to the IT infrastructure resources. Ultimately, an effective disposal solution is quickly generated, so it has the following technical effects:

[0164] (1) Improve processing enthusiasm: Shift from passive operation and maintenance to active operation and maintenance, and from passive problem analysis to active problem solving.

[0165] (2) Improved operation and maintenance efficiency: The present invention can quickly process massive amounts of alarm data. Traditional alarm analysis requires manual review of alarm information one by one, making it extremely inefficient when dealing with massive amounts of data. However, the present invention can classify, filter, and perform correlation analysis on a large number of alarms in a short period of time.

[0166] (3) Improved analysis accuracy: The present invention can accurately identify the type, severity, and associated events of an alarm. As a result, the accuracy of intelligent alarm analysis can be increased from 60%-70% of traditional methods to over 90%.

[0167] (4) Improving the timeliness of analysis: The present invention can receive newly generated alarms in real time, perform correlation analysis with ongoing events, and provide solutions or issue higher-level warnings in the first place.

[0168] (5) Accurate fault location: Through this multi-model collaboration + topology enhancement architecture, the AI ​​assistant can accurately locate faults in complex IT environments. Based on actual data from production environments, it can reduce MTTR (Meantime to repair) by 40-60% compared to traditional methods.

[0169] That is, the present invention can achieve the technical effects of improving processing enthusiasm, improving operation and maintenance efficiency, improving processing accuracy, improving processing timeliness and realizing accurate fault positioning, solving the problems of difficulty in tracing the source of alarm problems, difficulty in locating the root causes of problems and time-consuming fault recovery.

[0170] Example 2

[0171] Please refer to Figure 5 An intelligent alarm analysis and diagnosis device 1 based on an AI algorithm includes a memory 3, a processor 2, and a computer program stored in the memory 3 and executable on the processor 2. When the processor 2 executes the computer program, the steps in the above-mentioned embodiment 1 are implemented.

[0172] Since the systems / devices described in the above embodiments of the present invention are systems / devices used to implement the methods of the above embodiments of the present invention, those skilled in the art will be able to understand the specific structures and variations of these systems / devices based on the methods described in the above embodiments of the present invention, and thus will not be described in detail here. All systems / devices used in the methods of the above embodiments of the present invention are within the scope of protection of the present invention.

[0173] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0174] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions.

[0175] It should be noted that, in the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In claims enumerating several means, several of these means may be embodied by one and the same hardware. The use of the words first, second, third etc. is for convenience only and does not indicate any order. These words may be understood as part of the component name.

[0176] In addition, it should be noted that, in the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0177] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments after learning the basic creative concept. Therefore, the claims should be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0178] Obviously, those skilled in the art may make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if such modifications and variations fall within the scope of the claims and their equivalents, the present invention shall also include such modifications and variations.

Claims

1. An intelligent alarm analysis and diagnosis method based on AI algorithm, characterized by: Including steps: Acquire historical alarm data, train and generate a trend classification model and an alarm correlation engine based on the historical alarm data, train and generate matching and disposal rules based on the historical disposal data of the historical alarm data, establish a component positioning model based on the CMDB asset topology association relationship, and combine the trend classification model, the alarm correlation engine, the component positioning model, and the matching and disposal rules to generate a large model for intelligent alarm analysis and diagnosis; Acquire all real-time alarm data within a preset time window, input all real-time alarm data into the intelligent alarm analysis and diagnosis model, associate all real-time alarm data into multiple combined alarm records through the alarm association engine, obtain the fault type of each combined alarm record based on the type confidence distribution of each combined alarm record by the trend classification model and the component probability distribution of each combined alarm record by the component positioning model, obtain the specific fault location based on the component probability distribution, and generate an alarm handling suggestion for each combined alarm record based on the fault type and the specific fault location by the matching handling rule; Each combined alarm record is distributed based on the fault type, and an alarm handling suggestion is sent.

2. The intelligent alarm analysis and diagnosis method based on AI algorithm according to claim 1 is characterized in that: The training and generating of the trend classification model based on the historical alarm data comprises the following steps: The historical alarm data is normalized in time series, dynamic features are extracted from the normalized historical alarm data, the dynamic features are rolled out through time series statistics, the dynamic features are input into a pre-built trend classification model for training, and finally a trend classification model is generated.

3. The intelligent alarm analysis and diagnosis method based on AI algorithm according to claim 1 is characterized in that: Training and generating an alarm correlation engine based on the historical alarm data includes the following steps: Performing static rule association on the historical alarm data based on the equipment, time and monitoring indicators in the historical alarm data; Performing dynamic correlation mining on the alarm type, device, time, and monitoring indicators in the historical alarm data through machine learning; An alarm correlation engine is formed based on the associated static rules and the mined dynamic correlations.

4. The intelligent alarm analysis and diagnosis method based on AI algorithm according to claim 1 is characterized in that: The fault type of each combined alarm record obtained according to the type confidence distribution of each combined alarm record by the trend classification model and the component probability distribution of each combined alarm record by the component positioning model includes: For each combined alarm record, obtain the numerical features corresponding to the monitoring indicator, the text features corresponding to the alarm information, and the topological features obtained based on the CMDB asset topology association relationship according to the main alarm record in the combined alarm record; Inputting the numerical features and the text features into the trend classification model to obtain a type confidence distribution, and inputting the topological features into the component positioning model to obtain a component probability distribution; The type confidence distribution and the component probability distribution are integrated to construct an association matrix between fault types and components, and a final confidence of each fault type is obtained. The fault type with the highest final confidence is used as the fault type of the combined alarm record.

5. The intelligent alarm analysis and diagnosis method based on AI algorithm according to any one of claims 1 to 4, characterized in that: Also includes the steps: Generate a service dependency tree based on the CMDB asset topology relationship, generate an SLO evaluation formula based on the definition of SLO / SLI service levels in SRE operation and maintenance, and build an SLO health evaluation model based on the service dependency tree and the SLO evaluation formula; The step of obtaining the specific fault location through the component probability distribution further includes: The number of affected business units of the combined alarm record is calculated through the service dependency tree in the SLO health assessment model to obtain the impact range coefficient, and the SLO deviation of the combined alarm record is calculated and obtained through the SLO assessment formula in the SLO health assessment model. The priority score is obtained according to the impact range coefficient, the SLO deviation and the business weight in the combined alarm record, and the priority order of the combined alarm record is determined according to the priority score.

6. The intelligent alarm analysis and diagnosis method based on AI algorithm according to any one of claims 1 to 4, characterized in that: Also includes the steps: Prometheus is used to monitor and collect data, trigger and generate real-time alarm data, and receive the real-time alarm data through the Webhook interface of Alertmanager for storage.

7. The intelligent alarm analysis and diagnosis method based on AI algorithm according to any one of claims 1 to 4, characterized in that: The alarm data of the historical alarm data and the real-time alarm data include alarm information and context information, the alarm information is stored in a core alarm table, the context information is stored in a historical alarm table, a system status information table, and a device information table, the core alarm table is associated with the historical alarm table and the system status information table by a foreign key through an alarm unique identifier, and the core alarm table is associated with the device information table by a foreign key through a device unique identifier; The historical alarm table is used to record alarm status change information, and the system status information table is used to record monitoring indicator information when the alarm status changes.

8. The intelligent alarm analysis and diagnosis method based on AI algorithm according to any one of claims 1 to 4, characterized in that: Also includes the steps: The execution status of the alarm handling suggestions by the alarm handling personnel and the final processing results are recorded, and the execution status and the executed processing results are fed back to the intelligent alarm analysis and diagnosis model for model optimization and training.

9. The intelligent alarm analysis and diagnosis method based on AI algorithm according to any one of claims 1 to 4, characterized in that: Also includes the steps: Model and build critical infrastructure using digital twin technology to obtain a three-dimensional monitoring model that corresponds one-to-one with the critical infrastructure; Each combined alarm record is displayed on the three-dimensional monitoring model according to the specific fault location of each combined alarm record.

10. An intelligent alarm analysis and diagnosis device based on an AI algorithm, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the intelligent alarm analysis and diagnosis method based on the AI ​​algorithm according to any one of claims 1 to 9 is implemented.

Images