Alarm optimization method and device and electronic equipment

Abstract

The invention discloses an alarm optimization method and device and electronic equipment. The method comprises the following steps: acquiring monitoring index data of a cloud platform; the monitoring index data is processed through a target interpolation method, an index time sequence is obtained, the target interpolation method comprises a node adjustment strategy and a boundary switching mechanism, the node adjustment strategy is used for adjusting the distribution condition of interpolation nodes according to the change rate of the monitoring index data, and the boundary switching mechanism is used for switching the distribution condition of the interpolation nodes; the boundary switching mechanism is used for switching different boundary conditions according to the fluctuation degree of the monitoring index data; the index time sequence is predicted through a deep learning model, a prediction result is obtained, the deep learning model comprises a convolutional neural network and a long and short term memory neural network, and the prediction result comprises an abnormal probability value and an index change trend; and optimizing an alarm strategy according to a prediction result. According to the method and the device, the technical problem of high false alarm rate due to the fact that a cloud resource monitoring alarm mechanism in the related technology generally depends on a fixed threshold value or a simple statistical method is solved.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and more specifically, to an alarm optimization method, apparatus, and electronic device. Background Technology

[0002] With the popularization and deepening of cloud computing technology, the monitoring and management of cloud platforms and anomaly detection have become increasingly complex and important. In cloud resource monitoring, the alarm system plays a crucial role, responsible for monitoring various indicators and triggering alarms when they exceed preset thresholds, enabling operations and maintenance personnel to respond quickly and prevent the escalation of faults. However, the alarm mechanisms in related technologies have exposed a series of technical limitations when dealing with the dynamic characteristics and massive amounts of data of cloud platforms, severely restricting the accuracy and efficiency of alarm systems, specifically in the following aspects:

[0003] 1. Limitations of Static Threshold Alarms: Traditional alarm systems typically rely on fixed thresholds to trigger alarms, such as using CPU utilization exceeding 90% as a trigger. However, this approach is unsuitable for the dynamic changes in cloud platform load. Cloud platform resource usage is influenced by various factors, such as business traffic, seasonal fluctuations, and holiday effects, leading to drastically different normal ranges for the same metric at different times. Furthermore, fixed thresholds generate a large number of invalid alarm messages when metrics frequently fluctuate around the threshold, resulting in a so-called "alarm storm" that consumes significant operational effort and system resources.

[0004] 2. Limitations of Simple Statistical Methods: To address the limitations of static thresholds, some monitoring systems have introduced statistical methods such as moving averages and exponentially weighted moving averages. Moving averages smooth the indicator curve by calculating the average over a period of time, but this method is slow to respond to sudden, large-scale fluctuations and easily misses genuine anomalies. While exponentially weighted moving averages improve sensitivity to sudden fluctuations to some extent, their over-reliance on recent data points may misjudge short-term fluctuations within the normal range as anomalies, increasing the likelihood of false alarms. Neither of these methods can effectively distinguish between genuine abnormal signals and short-term indicator fluctuations, especially when indicators change drastically or suddenly.

[0005] 3. Limitations of Direct Application of Machine Learning: With the development of big data and artificial intelligence, attempts have begun to utilize machine learning to improve the accuracy and intelligence of alerts. However, directly inputting raw monitoring data into machine learning models presents two major challenges: First, data quality issues. Due to the discontinuous timestamps, inconsistent sampling frequencies, and noise interference of cloud monitoring data, the model training process is prone to instability. Second, the challenges of feature engineering. Traditional feature engineering methods struggle to capture the complex nonlinear relationships in the cloud environment, especially when multiple indicators interact; simple feature combinations cannot fully reflect this multi-dimensional impact.

[0006] There is currently no effective solution to the above problems. Summary of the Invention

[0007] This application provides an alarm optimization method, apparatus, and electronic device to at least solve the technical problem that cloud resource monitoring alarm mechanisms in related technologies typically rely on fixed thresholds or simple statistical methods, resulting in a high false alarm rate.

[0008] According to one aspect of the embodiments of this application, an alarm optimization method is provided, comprising: acquiring monitoring indicator data of a cloud platform; processing the monitoring indicator data using a target interpolation method to obtain an indicator time series, wherein the target interpolation method includes a node adjustment strategy and a boundary switching mechanism, the node adjustment strategy being used to adjust the distribution of interpolation nodes according to the rate of change of the monitoring indicator data, and the boundary switching mechanism being used to switch different boundary conditions according to the degree of fluctuation of the monitoring indicator data; predicting the indicator time series using a deep learning model to obtain a prediction result, wherein the deep learning model includes a convolutional neural network for extracting local features of the indicator time series and a long short-term memory neural network for extracting dependencies of the indicator time series, and the prediction result including anomaly probability values ​​and indicator change trends corresponding to the monitoring indicator data; and optimizing an alarm strategy based on the prediction result.

[0009] Optionally, the distribution of interpolation nodes can be adjusted based on the rate of change of the monitoring indicator data, including: determining the rate of change of the monitoring indicator data within a preset time window; increasing the number of interpolation nodes within the preset time window when the rate of change is greater than a preset change threshold; and decreasing the number of interpolation nodes within the preset time window when the rate of change is less than the preset change threshold.

[0010] Optionally, different boundary conditions can be switched based on the fluctuation level of the monitoring indicator data, including: determining the fluctuation level of the monitoring indicator data, wherein the fluctuation level is used to reflect the data changes of the monitoring indicator data; determining the normal period and the sudden period of the monitoring indicator data based on the fluctuation level, wherein the normal period is used to represent the period when the fluctuation level is less than the preset fluctuation range, and the sudden period is used to represent the period when the fluctuation level is greater than or equal to the preset fluctuation range; when the monitoring indicator data is in the normal period, the second derivative boundary is used; when the monitoring indicator data is in the sudden period, the first derivative boundary is used.

[0011] Optionally, the target interpolation method also includes a multi-indicator spatiotemporal alignment mechanism, including: determining a global time axis, wherein the global time axis is used to unify the time base of monitoring indicator data of multiple dimensions; and aligning monitoring indicator data of different dimensions and different timestamps to the global time axis according to a preset time interval.

[0012] Optionally, predicting the indicator time series using a deep learning model includes: processing the indicator time series through a feature extraction layer in the deep learning model to obtain a first indicator feature, wherein the first indicator feature includes local features extracted from the monitoring indicator data by a convolutional neural network and long-term dependencies extracted from the monitoring indicator data by a long short-term memory neural network; processing the first indicator feature through an attention layer in the deep learning model to obtain a second indicator feature, wherein the second indicator feature includes spatial features extracted from the first indicator feature through spatial attention and temporal features extracted from the first indicator feature through temporal attention; and processing the second indicator feature through a multi-task output layer in the deep learning model to obtain anomaly probability values ​​and indicator change trends.

[0013] Optionally, the method further includes: determining the model drift result of the deep learning model after processing the indicator time series, wherein the model drift result is used to reflect the decline in the predictive performance of the deep learning model over time; if the model drift result indicates that the deep learning model has drifted, retraining the deep learning model based on the historical time series and the indicator time series; if the model drift result indicates that the deep learning model has not drifted, updating the model parameters of the deep learning model based on the indicator time series.

[0014] Optionally, determining the model drift result after the deep learning model processes the indicator time series includes: determining the interpolation node corresponding to the monitoring indicator data and obtaining the sample indicator data at the interpolation node; determining the first prediction result and the second prediction result obtained by the deep learning model after processing the sample indicator data at the first time and the second time, respectively, wherein the first time is later than the second time; determining the probability difference between the first prediction result and the second prediction result, and calculating the mean of the probability difference to obtain the model drift score, wherein the model drift score is used to evaluate the model prediction ability of the deep learning model over time; and determining the model drift result based on the model drift score and a preset drift threshold.

[0015] Optionally, the alarm strategy can be optimized based on the prediction results, including: obtaining historical prediction results obtained by deep learning models predicting historical indicator time series; determining the mean and standard deviation of the prediction results and historical prediction results; and updating the alarm threshold in the alarm strategy based on the mean and standard deviation.

[0016] According to another aspect of the embodiments of this application, an alarm optimization device is also provided, comprising: an acquisition module for acquiring monitoring indicator data from a cloud platform; an interpolation module for processing the monitoring indicator data using a target interpolation method to obtain an indicator time series, wherein the target interpolation method includes a node adjustment strategy and a boundary switching mechanism, the node adjustment strategy being used to adjust the distribution of interpolation nodes according to the rate of change of the monitoring indicator data, and the boundary switching mechanism being used to switch different boundary conditions according to the degree of fluctuation of the monitoring indicator data; a prediction module for predicting the indicator time series using a deep learning model to obtain a prediction result, wherein the deep learning model includes a convolutional neural network for extracting local features of the indicator time series and a long short-term memory neural network for extracting dependencies of the indicator time series, and the prediction result includes an anomaly probability value and indicator change trend corresponding to the monitoring indicator data; and an optimization module for optimizing an alarm strategy based on the prediction result.

[0017] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and used to execute the alarm optimization method described above.

[0018] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned alarm optimization method by running the computer program.

[0019] According to another aspect of the embodiments of this application, a computer program product is also provided, including computer instructions that, when executed by a processor, implement the above-described alarm optimization method.

[0020] In this embodiment, monitoring indicator data of the cloud platform is acquired; the monitoring indicator data is processed using a target interpolation method to obtain an indicator time series. The target interpolation method includes a node adjustment strategy and a boundary switching mechanism. The node adjustment strategy adjusts the distribution of interpolation nodes based on the rate of change of the monitoring indicator data, and the boundary switching mechanism switches different boundary conditions based on the volatility of the monitoring indicator data. A deep learning model is used to predict the indicator time series, yielding a prediction result. The deep learning model includes a convolutional neural network for extracting local features of the indicator time series and a long short-term memory neural network for extracting dependencies in the indicator time series. The prediction result includes the anomaly probability value corresponding to the monitoring indicator data and the indicator change trend. Based on the prediction result, the alarm strategy is optimized, achieving the goal of accurately identifying cloud platform monitoring indicator anomalies and optimizing the alarm strategy. This improves the accuracy and response speed of anomaly detection, thus solving the technical problem of high false alarm rates in cloud resource monitoring alarm mechanisms that typically rely on fixed thresholds or simple statistical methods. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0022] Figure 1 This is a hardware structure diagram of a computer terminal for implementing an alarm optimization method according to an embodiment of this application;

[0023] Figure 2 This is a flowchart of an alarm optimization method according to an embodiment of this application;

[0024] Figure 3 This is a structural diagram of an alarm optimization system according to an embodiment of this application;

[0025] Figure 4 This is a flowchart of another alarm optimization method according to an embodiment of this application;

[0026] Figure 5 This is a structural diagram of a deep learning model according to an embodiment of this application;

[0027] Figure 6 This is a structural diagram of an alarm optimization device according to an embodiment of this application. Detailed Implementation

[0028] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] First, some nouns or terms that appear in the explanation of the embodiments of this application shall be interpreted as follows:

[0031] Alarm storm: refers to a situation where a monitoring system generates a large number of alarm notifications in a short period of time. This situation usually seriously interferes with the work of operation and maintenance personnel, causing important alarms to be ignored.

[0032] IaaS (Infrastructure as a Service): A cloud computing service model that allows users to access and use infrastructure-level resources, such as servers, storage, and networks, without owning and maintaining these hardware resources.

[0033] PaaS (Platform as a Service): A cloud computing service model that provides a platform on which users can build, run, and manage their own applications without having to manage the underlying hardware and operating system.

[0034] SaaS (Software as a Service): A cloud computing service model where users access software applications via the internet without needing to install and maintain the software locally; the service provider is responsible for the maintenance and upgrades of the software.

[0035] 1D-CNN (One-Dimensional Convolutional Neural Network): A variant of convolutional neural networks, primarily used to process one-dimensional data, such as time series data or speech signals, and can effectively capture local patterns in the data.

[0036] BiLSTM (Bidirectional Long Short-Term Memory): An extension of LSTM neural networks, capable of processing sequential data, particularly effective in time series prediction and natural language processing. Bidirectional BiLSTM can simultaneously utilize past and future information of a sequence, providing a more comprehensive contextual understanding.

[0037] Concept drift: refers to the phenomenon that changes in data distribution or concepts over time during the operation of a machine learning model, leading to a decline in the model's predictive performance.

[0038] To address the high false alarm rate in related technologies, this application provides an alarm optimization method that can be implemented in... Figure 1 The computer terminal shown is described below.

[0039] The alarm optimization method embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 A hardware block diagram of a computer terminal for implementing an alarm optimization method is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission module 106 for communication functions connected via wired and / or wireless networks. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art will understand that... Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0040] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be implemented wholly or partially as software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be wholly or partially integrated into any other element in the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as processor control (e.g., selection of a variable resistor termination path connected to an interface).

[0041] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the alarm optimization method in this embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the alarm optimization method described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0042] The transmission module 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission module 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission module 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0043] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0044] It should be noted here that, in some optional embodiments, the above... Figure 1 The computer terminal shown may include hardware elements (including circuitry), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware and software elements. It should be noted that... Figure 1 This is only one instance of a specific particular instance, and is intended to illustrate the types of components that may exist in the aforementioned computer terminal.

[0045] In the above operating environment, this application provides an embodiment of an alarm optimization method. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0046] Figure 2 This is a flowchart of an alarm optimization method according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0047] Step S202: Obtain monitoring indicator data from the cloud platform.

[0048] Step S204: The monitoring index data is processed by the target interpolation method to obtain the index time series. The target interpolation method includes a node adjustment strategy and a boundary switching mechanism. The node adjustment strategy is used to adjust the distribution of interpolation nodes according to the rate of change of the monitoring index data, and the boundary switching mechanism is used to switch different boundary conditions according to the degree of fluctuation of the monitoring index data.

[0049] Step S206: Predict the indicator time series using a deep learning model to obtain prediction results. The deep learning model includes a convolutional neural network for extracting local features of the indicator time series and a long short-term memory neural network for extracting dependencies of the indicator time series. The prediction results include the anomaly probability value and indicator change trend corresponding to the monitoring indicator data.

[0050] Step S208: Optimize the alarm strategy based on the prediction results.

[0051] Through the above steps S202 to S208, the goal of accurately identifying abnormal cloud platform monitoring indicators and optimizing alarm strategies is achieved, thereby improving the technical effect of anomaly detection accuracy and response speed. This solves the technical problem that cloud resource monitoring alarm mechanisms in related technologies usually rely on fixed thresholds or simple statistical methods, resulting in a high false alarm rate.

[0052] Figure 3 This is a structural diagram of an alarm optimization system according to an embodiment of this application, such as... Figure 3 As shown, the system includes a multi-dimensional data acquisition layer, an intelligent data preprocessing layer, a deep time series modeling layer, and a dynamic decision-making layer. The specific analysis of each layer is as follows:

[0053] 1. Multi-dimensional data acquisition layer: mainly responsible for collecting multi-dimensional performance indicator data from various monitoring data sources of the cloud platform, including but not limited to CPU utilization, memory usage, network traffic, etc.

[0054] 2. Intelligent Data Preprocessing Layer: Based on improved cubic spline interpolation technology, this layer performs spatiotemporal alignment and data smoothing on the collected monitoring data. This includes a dynamic node selection strategy and automatic switching of mixed boundary conditions. It can automatically adjust the interpolation node density according to the rate of change of the monitoring data, ensuring increased node density in areas of drastic data fluctuation and decreased node density in stable areas, thus optimizing computational efficiency. Simultaneously, boundary conditions can automatically switch according to the degree of data fluctuation to maintain the natural trend and physical constraints of the data.

[0055] 3. Deep Temporal Modeling Layer: The deep learning model includes an input layer, a feature extraction layer, an attention layer, and a multi-task output layer. The feature extraction layer integrates 1D-CNN and BiLSTM techniques to further analyze and extract features from preprocessed indicator data. 1D-CNN is used to capture local patterns and abrupt changes, while BiLSTM excels at handling long-term dependencies and periodic fluctuations. The attention layer includes spatial and temporal attention to identify spatiotemporal information in the sequence, improving the model's sensitivity to anomalies. The multi-task output layer can simultaneously predict anomaly probabilities and indicator change trends, providing comprehensive prediction results. Furthermore, the deep learning model supports online learning mechanisms, enabling it to detect concept drift and update the model accordingly, ensuring the stability of prediction performance.

[0056] 4. Dynamic Decision Layer: Primarily responsible for dynamically adjusting alarm strategies based on the output of the deep time series modeling layer, namely, the probability prediction of anomalies and the trend of indicator changes. For example, by calculating dynamic thresholds and combining anomaly probability and trend prediction, it assesses the confidence level of alarms, thereby making decisions on whether to trigger alarms and the alarm level.

[0057] Through the above four layers, the entire system effectively realizes intelligent collection, preprocessing, in-depth analysis, and dynamic decision-making of cloud platform monitoring data. It not only optimizes the alarm handling process and significantly improves operation and maintenance efficiency, but also enhances the accuracy of alarms and the robustness of the system through intelligent data preprocessing and deep learning models.

[0058] Figure 4 This is a flowchart of another alarm optimization method according to an embodiment of this application, such as... Figure 4 As shown, this illustrates in more detail the entire process from the initial reception and preprocessing of monitoring data, to the construction of deep learning models and the operation of online learning mechanisms, all the way to dynamic threshold calculation and final alarm output. The entire process is tightly integrated, forming an efficient and intelligent cloud platform alarm optimization method. The following section combines... Figure 4 The steps S202 to S208 described above will be explained in detail.

[0059] In step S202 above, the main responsibility is to collect real-time and historical monitoring metric data from the cloud platform. For example, multi-dimensional data is collected through a custom agent, including but not limited to key performance indicators (KPIs) such as CPU utilization, memory usage, and network traffic, while being compatible with heterogeneous data sources with different sampling frequencies, such as Zabbix and Prometheus.

[0060] In this embodiment, since the timestamp of the data source may differ due to different data acquisition tools, it is also necessary to determine the time format of the data when receiving monitoring indicator data to ensure data standardization and uniformity. If the timestamp is standard time, the next step of processing can proceed; otherwise, the timestamp of the data will be automatically converted to Coordinated Universal Time (UTC) to eliminate data alignment problems caused by different time zones, so that subsequent processing can be carried out under a unified time base.

[0061] In step S204 above, improved cubic spline interpolation (i.e., target interpolation) is used as the core technology for data preprocessing. Specifically, the improved cubic spline interpolation mainly uses a dynamic node selection strategy, an automatic boundary switching mechanism, and a multi-indicator spatiotemporal alignment mechanism to preprocess multi-source monitoring data from the cloud platform. By dynamically adjusting the distribution of interpolation nodes and selecting appropriate boundary conditions, it improves the quality of monitoring data, making it more suitable as input for deep learning models, while maintaining the physical continuity and trend consistency of the data. A detailed analysis follows:

[0062] I. Dynamic Node Selection Strategy

[0063] In traditional cubic spline interpolation, the nodes are fixed, meaning the sampling points of the data do not change. This method performs well in regions with gradual data changes, but may lead to information loss or calculation errors when the data fluctuates drastically. To overcome this limitation, this application proposes the concept of dynamic nodes, which can adjust the distribution of interpolation nodes according to the rate of change of the monitoring indicator data. This includes: determining the rate of change of the monitoring indicator data within a preset time window; increasing the number of interpolation nodes within the preset time window when the rate of change is greater than a preset threshold; and decreasing the number of interpolation nodes within the preset time window when the rate of change is less than the preset threshold.

[0064] Specifically, dynamic nodes refer to nodes whose locations are not fixed and whose density is variable. This means that the node distribution is adjusted in real time based on the actual characteristics of the monitored data (such as the rate of change). For example, when the rate of change of a monitored data point (such as CPU utilization) exceeds a set threshold within a preset time window, it indicates that the data is in a peak period of dynamic change. The system will automatically add additional interpolation nodes within this window to ensure accurate capture of subtle changes in the data and avoid missing crucial information. Conversely, if the rate of change is below the threshold, it indicates that the data is relatively stable, and the system will reduce the number of nodes. This not only maintains the smoothness of the data but also effectively saves computing resources and improves processing efficiency.

[0065] Through these two features, two key core issues are solved: 1) It overcomes the challenge of non-uniform sampling. Even if different monitoring indicators have different collection frequencies, the system can achieve smooth transition and alignment of data on the time axis by adjusting the node distribution in real time; 2) In response to the steep peaks and valleys in the original data caused by sudden fluctuations, the adaptive increase or decrease of dynamic node density ensures that data details can be fully captured when the load changes drastically, while the number of nodes is appropriately reduced during the stable period, achieving the dual purpose of optimizing computing resources and accurately reflecting data trends.

[0066] The specific dynamic node selection algorithm is as follows:

[0067] N_{new}=N_{base}+α*(du / dt) / (u_{max}-u_{min})

[0068] In the formula, N_{base} represents the number of basic interpolation nodes (distributed at equal time intervals by default); α represents the adjustment coefficient (the larger α is, the more sensitive it is to fluctuations, and more nodes are inserted; the smaller α is, the stronger the smoothing effect and the sparser the nodes); du / dt represents the rate of change of the index (when there are sharp fluctuations in the sampling interval, the rate of change is large, and more nodes are added to supplement details; when the rate of change is small, fewer nodes are reduced to save computing power); u_{max} and u_{min} represent the extreme values ​​of the index within the preset time window.

[0069] II. Automatic Boundary Switching Mechanism

[0070] In this embodiment, the intelligent data preprocessing layer also introduces hybrid boundary conditions to solve the fitted function and generate coefficients for cubic spline interpolation. These boundary conditions can be automatically switched based on the specific circumstances of the monitoring indicator data. For example, switching different boundary conditions based on the fluctuation level of the monitoring indicator data includes: determining the fluctuation level of the monitoring indicator data, where the fluctuation level reflects the data changes; determining the normal and sudden periods of the monitoring indicator data based on the fluctuation level, where the normal period represents the time when the fluctuation level is less than a preset fluctuation range, and the sudden period represents the time when the fluctuation level is greater than or equal to the preset fluctuation range; using the second derivative boundary when the monitoring indicator data is in the normal period; and using the first derivative boundary when the monitoring indicator data is in the sudden period. The specific boundary condition analysis is as follows:

[0071] Natural boundary conditions: In normal periods when data fluctuations are small and changes are gradual, using natural boundary conditions, which means setting the second derivatives at both ends of the spline function to zero, helps to reduce data edge effects and improve the smoothness of interpolation results.

[0072] Fixed first derivative boundary condition: When data experiences sudden changes or drastic fluctuations, using a fixed first derivative boundary condition helps to capture the abrupt changes in the data, avoids underreporting in abnormal situations, and ensures that the trend can still be accurately reflected during periods of rapid data change.

[0073] Subsequently, a smooth time series is generated based on the determined interpolation coefficients, thereby transforming the original irregular and fluctuating monitoring indicator data into a continuous and smooth form to facilitate the training and prediction of subsequent deep learning models.

[0074] III. Multi-indicator spatiotemporal alignment

[0075] In this embodiment of the application, the multi-indicator spatiotemporal alignment mechanism includes: determining a global time axis, wherein the global time axis is used to unify the time base of monitoring indicator data of multiple dimensions; and aligning monitoring indicator data of different dimensions and different timestamps to the global time axis according to a preset time interval.

[0076] Specifically, considering the diversity and complexity of monitoring data in the cloud platform, the intelligent data preprocessing layer also faces the challenges of maintaining physical constraints for multiple indicators and integrating heterogeneous data sources. To address this, the system establishes a global timeline onto which data for all monitoring indicators is mapped, ensuring consistency across time for data from different sources and with different sampling frequencies. Through this global perspective, even if timestamps between different data sources are not perfectly synchronized, interpolation and other methods can be used to align all indicator data into a unified time frame, greatly facilitating subsequent analysis and modeling.

[0077] In step S206 above, by combining the advantages of 1D-CNN and BiLSTM, and introducing the attention mechanism, the deep learning model can accurately predict the time series of indicators. It can detect the probability of anomalies and predict the trend of indicator changes, providing a scientific basis for determining the dynamic threshold.

[0078] In this embodiment of the application, after data preprocessing is completed, the deep learning model construction stage will begin. For example... Figure 5 As shown, the model structure includes multiple layers, from the input layer to the output layer: interpolated sequence value input, feature extraction layer, attention layer, and multi-task output layer. A detailed analysis follows:

[0079] 1. Input layer: Input the interpolated index time series (length T, dimension D).

[0080] 2. Feature extraction layer: includes 1D-CNN and BiLSTM.

[0081] 1D-CNN is used to extract local features of indicator time series and capture short-term trend changes;

[0082] BiLSTM excels at handling long dependencies and can identify periodic patterns and long-term trends in data.

[0083] 3. Attention layer: Includes spatial attention and temporal attention calculations.

[0084] class SpatioTemporalAttention(Layer):

[0085] def call(self, inputs):

[0086] #Spatial Attention (Across Feature Dimensions)

[0087] spatial_att=Dense(inputs.shape[-1],activation='softmax')(inputs)

[0088] #TimeAttention (Across Time Dimensions)

[0089] temporal_att=Dense(inputs.shape[1],activation='softmax')(inputs)

[0090] #Converged Computing

[0091] return inputs*spatial_att*temporal_att

[0092] The specific explanation is as follows:

[0093] a. Spatial attention spans feature dimensions, focusing on the most important attributes in the data.

[0094] spatial_att=Dense(inputs.shape[-1],activation='softmax')(inputs)

[0095] Here, `inputs.shape[-1]` represents the size of the input tensor in the last dimension (feature dimension). `Dense(inputs.shape[-1], activation='softmax')` creates a fully connected layer whose output dimension is equal to the number of input features. The softmax activation function is used to make the output values ​​represent attention weights in the spatial dimension, used to determine the importance of each input feature. This operation generates an attention value for each input feature, and these attention values ​​influence subsequent computations in a weighted manner.

[0096] b. Time attention focuses on key time points in the sequence, enhancing the response to abnormal time windows.

[0097] temporal_att=Dense(inputs.shape[1],activation='softmax')(inputs)

[0098] Wherein, inputs.shape[1] is the size of the input tensor in the time dimension (usually representing the number of time steps or the sequence length). Similarly, a fully connected layer is created using Dense(inputs.shape[1], activation='softmax'), whose output dimension is equal to the size of the time dimension. Each time step in the time dimension is weighted using the softmax activation function. This operation generates an attention value for each time step, which is used to determine which time steps are more important to the task.

[0099] c. Fusion computing.

[0100] return inputs*spatial_att*temporal_att

[0101] Finally, spatial attention and temporal attention are multiplied element-wise with the original inputs. `inputs*spatial_att` adjusts the feature dimensions of the inputs based on spatial attention, while `*temporal_att` further adjusts the temporal dimension based on temporal attention. This step results in a weighted representation of the original inputs, allowing the model to focus on the more important parts in both the spatial and temporal dimensions.

[0102] 4. Multi-task output layer: Outputs two results. The first is the anomaly probability prediction of the main task, which outputs a probability value through the Sigmoid function to determine whether the current sample is an anomaly. The second is the indicator change trend prediction of the auxiliary task, which outputs multi-dimensional trend information through Linear regression as a decision reference.

[0103] After the aforementioned deep learning model is constructed, the time series of indicators is predicted, including: processing the time series of indicators through the feature extraction layer in the deep learning model to obtain the first indicator feature, wherein the first indicator feature includes local features extracted from the monitoring indicator data by the convolutional neural network and long-term dependencies extracted from the monitoring indicator data by the long short-term memory neural network; processing the first indicator feature through the attention layer in the deep learning model to obtain the second indicator feature, wherein the second indicator feature includes spatial features extracted from the first indicator feature through spatial attention and temporal features extracted from the first indicator feature through temporal attention; and processing the second indicator feature through the multi-task output layer in the deep learning model to obtain the anomaly probability value and the indicator change trend.

[0104] In this embodiment, an online learning mechanism is also included to ensure that the model can adapt to real-time changes in the cloud environment. This online learning mechanism includes sliding window incremental training. When the system detects concept drift (i.e., a change in data distribution or pattern), it triggers full training of the model. Under stable concept conditions, the system fine-tunes the model parameters by updating a small amount of new data to maintain the model's timeliness and accuracy.

[0105] Specifically, this sliding window incremental training can be achieved in the following ways: determining the model drift result of the deep learning model after processing the indicator time series, wherein the model drift result is used to reflect the decline in the predictive performance of the deep learning model over time; if the model drift result indicates that the deep learning model has drifted, retraining the deep learning model based on the historical time series and the indicator time series; if the model drift result indicates that the deep learning model has not drifted, updating the model parameters of the deep learning model based on the indicator time series.

[0106] Concept drift detection, which determines the model drift result after the deep learning model processes the indicator time series, includes: identifying the interpolation node corresponding to the monitoring indicator data and obtaining the sample indicator data at the interpolation node; determining the first prediction result and the second prediction result obtained by the deep learning model after processing the sample indicator data at the first time and the second time, respectively, wherein the first time is later than the second time; determining the probability difference between the first prediction result and the second prediction result, and calculating the mean of the probability difference to obtain the model drift score, wherein the model drift score is used to evaluate the model prediction ability of the deep learning model over time; and determining the model drift result based on the model drift score and the preset drift threshold.

[0107]

[0108] In the formula, drift_score represents the model drift score; n represents the number of samples in the detection window, and p t (i) represents the predicted output (anomaly probability) of the deep learning model for the i-th sample at the current time t (i.e., the first time); p t-1 (i) represents the prediction output of the deep learning model for the same batch of samples at the previous time t-1 (i.e. the second time).

[0109] In step S208 above, the main responsibility is to dynamically adjust the alarm strategy based on the anomaly probability value and indicator change trend predicted by the deep learning model, reduce false alarms and false negatives, and improve operation and maintenance efficiency.

[0110] In this embodiment of the application, optimizing the alarm strategy based on the prediction results includes: obtaining historical prediction results obtained by a deep learning model predicting historical indicator time series; determining the average and standard deviation of the prediction results and the historical prediction results; and updating the alarm threshold in the alarm strategy based on the average and standard deviation.

[0111] The core idea behind automatically adjusting alarm thresholds by statistically analyzing historical data is to combine the average level of indicators over a period of time with a safety margin to form a dynamic threshold. This effectively avoids frequent false alarms or missed alarms caused by improperly set fixed thresholds. The specific expression is as follows:

[0112]

[0113] Threshold t =μ+σ

[0114] In the formula, Threshold t The adjusted dynamic threshold; μ and σ represent the mean and standard deviation of the predicted result and the historical predicted result, respectively; n represents the number of sampling points in the past T time period; t(i) represents the sample value corresponding to each sampling point.

[0115] Based on the prediction results output by the deep learning model, the confidence level of the alarm is further evaluated. For example, by combining the anomaly probability and the trend of indicator changes, a comprehensive decision-making strategy is formulated. An alarm will only be triggered when the anomaly probability exceeds a certain threshold or when the trend changes significantly. Otherwise, the system will mark it as a potential risk or a normal state, thereby reducing the generation of invalid alarms.

[0116] Taking CPU alarms as an example: In a cloud environment, a server's CPU utilization threshold is set to 90%. An alarm is triggered when the CPU utilization exceeds this threshold. However, due to load fluctuations, the CPU utilization may repeatedly fluctuate around the threshold (e.g., 89%→91%→88%→92%), resulting in a large number of duplicate alarms generated in a short period (i.e., "threshold oscillation alarms"). Specific alarm optimization steps are as follows:

[0117] Step 1: Read existing historical indicator data. This historical indicator data is stored in the Zabbix database and can be retrieved from relevant tables based on IP information.

[0118] Step 2: Historical indicator data preprocessing, converting discrete and fluctuating CPU utilization data into smooth and continuous data, as shown in Table 1:

[0119] Table 1 Historical Indicator Data

[0120] Timestamp CPU utilization Trigger alarm 09:30:12.043 88.2％ × 09:31:12.723 92.1％ √ 09:32:12.172 89.5％ × 09:33:11.995 93.4％ √ ... ... ...

[0121] Step 3: Perform interpolation using the target interpolation method.

[0122] Step 4: Generate a cubic spline function and fit a piecewise cubic polynomial using CubicSpline to ensure the continuity of the first and second derivatives.

[0123] Step 5: Output the historical index time series at equal intervals, as shown in Table 2, which contains smoothed data at one point per minute.

[0124] Table 1 Historical Indicator Time Series

[0125] Timestamp CPU utilization 09:30:12.043 88.2％ 09:31:12.723 88.6％ 09:32:12.172 92.0％ 09:33:11.995 89.1％ ... ...

[0126] Step 6: Feature engineering and LSTM input construction, converting the interpolated historical index time series into time series samples that can be trained by LSTM.

[0127] (1) Feature design

[0128] Main feature: Interpolated CPU utilization sequence.

[0129] Replication characteristics (optional): First derivative of the interpolation function (reflecting the CPU rate of change); or mean / variance over the past 5 minutes (window statistic).

[0130] (2) Sliding window segmentation

[0131] Window length: 10 minutes. Different monitoring metrics can be adjusted according to business needs.

[0132] Step size: 1 minute. This can be shortened appropriately for critical monitoring indicators with high real-time performance requirements.

[0133] Sample example:

[0134] # Enter X (CPU sequence of the past 10 minutes)

[0135] [88.2,88.6,92.0,89.1,91.5,92.8,91.0,89.5,88.3,87.0]

[0136] # Output y (whether to issue an alarm in the next minute) 0

[0138] Step 7: Deep learning model training and prediction.

[0139] (1) Model Structure

[0140] from tensorflow.keras.models import Sequential

[0141] from tensorflow.keras.layers import LSTM,Dense

[0142] model = Sequential([

[0143] LSTM(64, input_shape = (10, 1), # Input: 10 time steps, 1 feature

[0144] Dense(16,activation='relu'),

[0145] Dense(1, activation='sigmoid') # Binary classification output ])

[0147] model.compile(optimizer='adam',loss='binary_crossentropy',metrics=['accuracy'])

[0148] (2) Training data generation

[0149] import numpy as np

[0150] #smoothed_data is the interpolated CPU sequence

[0151] X,y=[],[]

[0152] window_size = 10

[0153] for iin range(len(smoothed_data)-window_size):

[0154] X.append(smoothed_data[i:i+window_size])

[0155] y.append(1 if raw_labels[i+window_size]==1 else 0) # raw_labels are the original alarm labels

[0156] X=np.array(X).reshape(-1,window_size,1)

[0157] y = np.array(y)

[0158] (3) Improvement

[0159] Label smoothing: If the CPU is near the threshold after interpolation but still does not exceed the threshold, the label can be set to 0.5 (probabilistic label) to reduce the model's sensitivity to small fluctuations.

[0160] Sample weighting: Increase the weight of samples during the actual alarm outbreak period to solve the class imbalance problem.

[0161] Step 8: Online prediction and alarm suppression.

[0162] (1) Real-time interpolation

[0163] Dynamic interpolation is performed on the newly acquired CPU data.

[0164] (2) Forecasting and Decision Making

[0165] If the LSTM output probability is greater than 0.7, it is determined to be a "real alarm" and a notification is triggered.

[0166] If the probability is between 0.3 and 0.7, it is judged as a "potential risk" and only recorded in the log.

[0167] If the probability is less than 0.3, ignore the current fluctuation.

[0168] (3) Feedback optimization

[0169] Manually verified false positives / false negatives are added to the training set, and the model is updated iteratively.

[0170] In this embodiment, improved cubic spline interpolation is combined with deep learning technology and applied to optimize dynamic threshold alarms on a cloud platform. In particular, the application of dynamic node selection strategies and mixed boundary conditions effectively addresses the challenges posed by non-uniform sampling and sudden fluctuations in monitoring data. This alarm optimization scheme can automatically adjust the distribution and density of interpolation nodes based on the actual changes in the data, achieving a balance between data smoothing and detail preservation. Simultaneously, through a sliding window incremental training mechanism, the system can monitor and adaptively adjust model parameters in real time to address concept drift and ensure long-term stable prediction accuracy.

[0171] In summary, this application significantly reduces invalid alarms caused by static thresholds and simple statistical methods, alleviates the pressure on operations and maintenance personnel to handle alarm storms, and improves the sensitivity and accuracy of anomaly detection. Through probabilistic dynamic decision-making, it can not only more accurately identify real anomalies but also effectively distinguish between potential risks and normal fluctuations, thereby improving the timeliness of anomaly handling and the efficiency of operations and maintenance, ultimately ensuring the stable operation and service quality of the cloud platform.

[0172] According to embodiments of this application, an alarm optimization device is provided. It should be noted that the alarm optimization device of this application can be used to execute the alarm optimization method provided in the embodiments of this application. The alarm optimization device provided in the embodiments of this application will be described below.

[0173] Figure 6 This is a structural diagram of an alarm optimization device provided according to an embodiment of this application. Figure 6 As shown, the device includes:

[0174] Module 60 is used to acquire monitoring metric data from the cloud platform;

[0175] Interpolation module 62 is used to process monitoring indicator data using the target interpolation method to obtain indicator time series. The target interpolation method includes a node adjustment strategy and a boundary switching mechanism. The node adjustment strategy is used to adjust the distribution of interpolation nodes according to the rate of change of monitoring indicator data, and the boundary switching mechanism is used to switch different boundary conditions according to the degree of fluctuation of monitoring indicator data.

[0176] The prediction module 64 is used to predict the indicator time series through a deep learning model and obtain the prediction result. The deep learning model includes a convolutional neural network for extracting local features of the indicator time series and a long short-term memory neural network for extracting the dependencies of the indicator time series. The prediction result includes the anomaly probability value and indicator change trend corresponding to the monitoring indicator data.

[0177] Optimization module 66 is used to optimize alarm strategies based on prediction results.

[0178] Through the acquisition module, interpolation module, prediction module and optimization module in the above alarm optimization device, the purpose of accurately identifying abnormal cloud platform monitoring indicators and optimizing alarm strategies is achieved. This realizes the technical effect of improving the accuracy of anomaly detection and response speed, and solves the technical problem of high false alarm rate caused by cloud resource monitoring alarm mechanisms in related technologies that usually rely on fixed thresholds or simple statistical methods.

[0179] In the alarm optimization device provided in this application embodiment, the interpolation module is further used to determine the rate of change of monitoring indicator data within a preset time window; when the rate of change is greater than a preset change threshold, the interpolation node within the preset time window is increased; when the rate of change is less than the preset change threshold, the interpolation node within the preset time window is decreased.

[0180] In the alarm optimization device provided in this application embodiment, the interpolation module is further used to determine the fluctuation level of the monitoring indicator data, wherein the fluctuation level is used to reflect the data change of the monitoring indicator data; the normal period and the sudden period of the monitoring indicator data are determined according to the fluctuation level, wherein the normal period is used to represent the time period when the fluctuation level is less than the preset fluctuation range, and the sudden period is used to represent the time period when the fluctuation level is greater than or equal to the preset fluctuation range; when the monitoring indicator data is in the normal period, the second derivative boundary is used; when the monitoring indicator data is in the sudden period, the first derivative boundary is used.

[0181] In the alarm optimization device provided in this application embodiment, the interpolation module is also used to determine the global time axis, wherein the global time axis is used to unify the time base of monitoring indicator data of multiple dimensions; according to the preset time interval, the monitoring indicator data of different dimensions and different timestamps are aligned to the global time axis.

[0182] In the alarm optimization device provided in this application embodiment, the prediction module is further used to process the indicator time series through the feature extraction layer in the deep learning model to obtain a first indicator feature, wherein the first indicator feature includes local features extracted from the monitoring indicator data by the convolutional neural network and long-term dependencies extracted from the monitoring indicator data by the long short-term memory neural network; to process the first indicator feature through the attention layer in the deep learning model to obtain a second indicator feature, wherein the second indicator feature includes spatial features extracted from the first indicator feature through spatial attention and temporal features extracted from the first indicator feature through temporal attention; and to process the second indicator feature through the multi-task output layer in the deep learning model to obtain anomaly probability values ​​and indicator change trends.

[0183] In the alarm optimization device provided in this application embodiment, the optimization module is further used to obtain the historical prediction results obtained by the deep learning model predicting the historical indicator time series; determine the average value and standard deviation of the prediction results and the historical prediction results; and update the alarm threshold in the alarm strategy based on the average value and standard deviation.

[0184] The alarm optimization device provided in this application embodiment further includes a training module 68, which is used to determine the model drift result of the deep learning model after processing the indicator time series. The model drift result is used to reflect the decline in the prediction performance of the deep learning model over time. If the model drift result indicates that the deep learning model has drifted, the deep learning model is retrained based on the historical time series and the indicator time series. If the model drift result indicates that the deep learning model has not drifted, the model parameters of the deep learning model are updated based on the indicator time series.

[0185] In the alarm optimization device provided in this application embodiment, the training module is further used to determine the interpolation node corresponding to the monitoring index data and obtain the sample index data at the interpolation node; determine the first prediction result and the second prediction result obtained by the deep learning model after processing the sample index data at the first time and the second time, respectively, wherein the first time is later than the second time; determine the probability difference between the first prediction result and the second prediction result, and calculate the mean of the probability difference to obtain the model drift score, wherein the model drift score is used to evaluate the model prediction ability of the deep learning model over time; and determine the model drift result based on the model drift score and the preset drift threshold.

[0186] This application also provides an electronic device, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and used to execute the alarm optimization method described above.

[0187] It should be noted that the aforementioned electronic equipment is used to perform Figure 2 The alarm optimization method shown above is also applicable to this electronic device, and will not be repeated here.

[0188] This application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device containing the non-volatile storage medium executes the above-mentioned alarm optimization method by running the computer program.

[0189] It should be noted that the aforementioned non-volatile storage media is used for execution. Figure 2 The alarm optimization method shown above is also applicable to this non-volatile storage medium, and will not be repeated here.

[0190] This application also provides a computer program product, including computer instructions that, when executed by a processor, implement the above-described alarm optimization method.

[0191] It should be noted that the above-mentioned computer program product is used to execute Figure 2 The alarm optimization method shown above is also applicable to this computer program product, and will not be repeated here.

[0192] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0193] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0194] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0195] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0196] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0197] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0198] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An alarm optimization method, characterized in that, include: Obtain monitoring metrics data from the cloud platform; The monitoring indicator data is processed by a target interpolation method to obtain an indicator time series. The target interpolation method includes a node adjustment strategy and a boundary switching mechanism. The node adjustment strategy is used to adjust the distribution of interpolation nodes according to the rate of change of the monitoring indicator data. The boundary switching mechanism is used to switch different boundary conditions according to the degree of fluctuation of the monitoring indicator data. The time series of the indicator is predicted by a deep learning model to obtain a prediction result. The deep learning model includes a convolutional neural network for extracting local features of the time series of the indicator and a long short-term memory neural network for extracting the dependencies of the time series of the indicator. The prediction result includes the anomaly probability value and indicator change trend corresponding to the monitoring indicator data. Optimize the alarm strategy based on the prediction results.

2. The method according to claim 1, characterized in that, Adjusting the distribution of interpolation nodes based on the rate of change of the monitored indicator data includes: Determine the rate of change of the monitoring indicator data within a preset time window; If the rate of change is greater than a preset change threshold, an interpolation node is added within the preset time window; If the rate of change is less than a preset change threshold, the number of interpolation nodes within the preset time window is reduced.

3. The method according to claim 1, characterized in that, Switching different boundary conditions based on the fluctuation level of the monitored indicator data includes: Determine the degree of fluctuation of the monitoring indicator data, wherein the degree of fluctuation is used to reflect the data change of the monitoring indicator data; Based on the degree of fluctuation, the normal time period and the sudden time period of the monitoring indicator data are determined, wherein the normal time period is used to represent the time period when the degree of fluctuation is less than a preset fluctuation range, and the sudden time period is used to represent the time period when the degree of fluctuation is greater than or equal to the preset fluctuation range; When the monitored indicator data is within the normal time period, the second derivative boundary is used; When the monitored indicator data is within the period of the sudden event, the first derivative boundary is used.

4. The method according to claim 1, characterized in that, The target interpolation method also includes a multi-index spatiotemporal alignment mechanism, including: Determine a global timeline, wherein the global timeline is used to unify the time base for monitoring indicator data across multiple dimensions; Based on a preset time interval, the monitoring indicator data under different dimensions and timestamps are aligned to the global time axis.

5. The method according to claim 1, characterized in that, Predicting the time series of the aforementioned indicator using a deep learning model includes: The indicator time series is processed by the feature extraction layer in the deep learning model to obtain the first indicator feature, wherein the first indicator feature includes the local features extracted by the convolutional neural network from the monitoring indicator data and the long-term dependency relationship extracted by the long short-term memory neural network from the monitoring indicator data. The first indicator feature is processed by the attention layer in the deep learning model to obtain the second indicator feature, wherein the second indicator feature includes spatial features extracted from the first indicator feature through spatial attention and temporal features extracted from the first indicator feature through temporal attention. The second indicator feature is processed by the multi-task output layer in the deep learning model to obtain the anomaly probability value and the indicator change trend.

6. The method according to claim 1, characterized in that, The method further includes: Determine the model drift result of the deep learning model after processing the time series of the indicator, wherein the model drift result is used to reflect the decline in the predictive performance of the deep learning model over time; If the model drift result indicates that the deep learning model has drifted, the deep learning model is retrained based on the historical time series and the index time series. If the model drift result indicates that the deep learning model has not drifted, the model parameters of the deep learning model are updated according to the time series of the indicator.

7. The method according to claim 6, characterized in that, Determining the model drift result of the deep learning model after processing the time series of the indicator includes: Determine the interpolation node corresponding to the monitoring indicator data, and obtain the sample indicator data at the interpolation node; The deep learning model obtains a first prediction result and a second prediction result after processing the sample index data at a first time and a second time, respectively, wherein the first time is later than the second time. The probability difference between the first prediction result and the second prediction result is determined, and the mean of the probability difference is calculated to obtain the model drift score, wherein the model drift score is used to evaluate the model prediction ability of the deep learning model over time. The model drift result is determined based on the model drift score and the preset drift threshold.

8. The method according to claim 1, characterized in that, Optimize the alarm strategy based on the prediction results, including: Obtain the historical prediction results obtained by the deep learning model on the time series of historical indicators; Determine the mean and standard deviation of the predicted results and the historical predicted results; The alarm threshold in the alarm strategy is updated based on the average value and the standard deviation.

9. An alarm optimization device, characterized in that, include: The acquisition module is used to acquire monitoring metric data from the cloud platform. An interpolation module is used to process the monitoring indicator data using a target interpolation method to obtain an indicator time series. The target interpolation method includes a node adjustment strategy and a boundary switching mechanism. The node adjustment strategy is used to adjust the distribution of interpolation nodes according to the rate of change of the monitoring indicator data, and the boundary switching mechanism is used to switch different boundary conditions according to the degree of fluctuation of the monitoring indicator data. The prediction module is used to predict the time series of the indicator using a deep learning model to obtain prediction results. The deep learning model includes a convolutional neural network for extracting local features of the time series of the indicator and a long short-term memory neural network for extracting the dependencies of the time series of the indicator. The prediction results include anomaly probability values ​​and indicator change trends corresponding to the monitoring indicator data. The optimization module is used to optimize the alarm strategy based on the prediction results.

10. An electronic device, characterized in that, include: A memory and a processor, wherein the memory is used to store program instructions; The processor, connected to the memory, is used to execute the alarm optimization method according to any one of claims 1 to 8.

11. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored computer program, wherein the device containing the non-volatile storage medium executes the alarm optimization method according to any one of claims 1 to 8 by running the computer program.

12. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the alarm optimization method according to any one of claims 1 to 8.

Images