Short text-oriented alarm information fast convergence method and system

Abstract

The application discloses a short text-oriented alarm information quick convergence method and system, relates to the field of data processing, and comprises the following steps: receiving a plurality of short text alarm information sent by a target system, performing natural language processing and semantic analysis, and generating a plurality of alarm semantic information; inputting a double-path parallel model to perform classification and clustering processing, and generating alarm classification results and alarm clustering results; based on classification probability identification, the alarm classification results and the alarm clustering results are aggregated to generate alarm aggregation results; the system real-time pressure characteristics of the target system are collected, the alarm convergence granularity is adjusted, the alarm aggregation results are combined, the alarm convergence operation is automatically triggered, and an alarm report is generated. The technical problems of inaccurate alarm convergence and low efficiency of operation and maintenance personnel in processing alarms existing in the prior alarm information processing for short texts are solved, and the technical effects of quickly and accurately realizing alarm information convergence and improving the efficiency of operation and maintenance personnel in processing alarms are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, in particular to a short text-oriented alarm information fast convergence method and system. BACKGROUND

[0002] In modern complex information systems, a large amount of short text alarm information is generated every day. These alarm information not only has a large quantity, but also may have association or repetition among them. How to quickly and accurately process these alarm information, avoid alarm storm to interfere with the operation and maintenance personnel, and ensure the stable operation of the system, has become an important problem to be solved. At present, the main method to solve this problem is to classify and converge the alarm information based on simple rule matching or traditional clustering algorithm. For example, some keywords rules are set, when the alarm information contains specific keywords, it is classified into the same class; or the traditional K-means clustering algorithm is used, and clustering is performed according to the similarity of alarm text.

[0003] However, the current method has many problems. On the one hand, the rule matching method has poor flexibility, the rule setting requires a lot of manual experience and time cost, and it is difficult to deal with complex and variable alarm scenes. Once the rule setting is unreasonable, it is easy to cause classification error or miss important alarm; on the other hand, the traditional clustering algorithm has high requirements for data distribution and features. When facing high-dimensional and complex semantic short text alarm information, the clustering effect is often not ideal, it is difficult to accurately identify the alarm information with internal association, which leads to inaccurate alarm convergence, and the operation and maintenance personnel still need to spend a lot of time on invalid alarm, and cannot timely process the real key alarm problem.

[0004] At present, in the related art, the short text-oriented alarm information processing has the technical problem of inaccurate alarm convergence, which leads to low efficiency of the operation and maintenance personnel in processing alarm. SUMMARY

[0005] The present application provides a short text-oriented alarm information fast convergence method and system. The natural language processing and semantic analysis technology are used to preprocess the alarm information to generate alarm semantic information. A double-path parallel model is used to classify and cluster the alarm semantic information, and the results are aggregated based on classification probability identification. The alarm convergence granularity is adjusted in combination with the real-time pressure characteristics of the system. The technical problem of inaccurate alarm convergence in the existing short text-oriented alarm information processing, which leads to low efficiency of the operation and maintenance personnel in processing alarm, is solved. The technical effect of quickly and accurately realizing alarm information convergence and improving the efficiency of the operation and maintenance personnel in processing alarm is achieved.

[0006] The application provides a short text-oriented alarm information rapid convergence method, including: receiving a plurality of short text alarm information sent by a target system, and performing natural language processing and semantic analysis to generate a plurality of alarm semantic information; inputting the plurality of alarm semantic information into a double-path parallel model for classification and clustering processing to generate alarm classification results and alarm clustering results, wherein the classification result of each alarm semantic information in the alarm classification result includes an alarm classification label and a classification probability identifier; based on the classification probability identifier, the alarm classification results and the alarm clustering results are aggregated to generate alarm aggregation results; collecting system real-time pressure features of the target system, adjusting the alarm convergence granularity, and combining the alarm aggregation results to automatically trigger an alarm convergence operation to generate an alarm report.

[0007] In a possible implementation, the following processing is performed: the double-path parallel model includes a classification model and a clustering model, and the clustering model includes a density clustering layer and a graph structure spectral clustering layer.

[0008] In a possible implementation, the following processing is performed when the plurality of alarm semantic information is input into the double-path parallel model for classification and clustering processing to generate alarm classification results and alarm clustering results: the classification model is used to perform alarm type decision and classification certainty analysis on the plurality of alarm semantic information to generate a plurality of groups of alarm classification labels and classification probability identifiers, and the alarm classification results are constructed; the density clustering layer in the clustering model is used to cluster high-density local alarm clusters based on alarm density; and the graph structure spectral clustering layer is used to perform spectral decomposition of alarm items based on the high-density local alarm clusters to generate a hierarchical structure, and the alarm clustering results are generated based on the hierarchical structure.

[0009] In a possible implementation, the following processing is performed when the graph structure spectral clustering layer is used to perform spectral decomposition of alarm items based on the high-density local alarm clusters to generate a hierarchical structure: the graph structure spectral clustering layer is used to construct a similarity graph between alarm items based on the high-density local alarm clusters; spectral decomposition is performed on the similarity graph to obtain eigenvalues and eigenvectors; based on the eigenvalues and eigenvectors, the smallest k eigenvectors are selected; the k eigenvectors are input as updated features to perform clustering to obtain the hierarchical structure; and the value of k is the serial number corresponding to the maximum point between adjacent eigenvalues in the order of eigenvalues from small to large in the spectral decomposition process.

[0010] In a possible implementation, the following processing is performed: the similarity graph is a similarity matrix based on semantic similarity, time proximity, and IP / node ownership consistency.

[0011] In a possible implementation, based on the classification probability identifier, the alarm classification result and the alarm clustering result are aggregated to generate an alarm aggregation result, and the following processing is performed: based on the classification probability identifier, a first classification subset with a probability less than a first probability threshold in the alarm classification result is identified, and the first classification subset is an uncertain classification subset; the first classification subset is aggregated based on the alarm clustering result to generate a first aggregation result; based on the classification probability identifier, a second classification subset with a probability greater than the first probability threshold and less than a second probability threshold in the alarm classification result is identified, and the classification probability identifier and the confidence score of the corresponding clustering result in the alarm clustering result are preferentially aggregated to generate a second aggregation result; based on the classification probability identifier, a third classification subset with a probability greater than the second probability threshold in the alarm classification result is identified, and the alarm classification labels are aggregated to generate a third aggregation result; and the first aggregation result, the second aggregation result, and the third aggregation result are used to generate the alarm aggregation result.

[0012] In a possible implementation, the following processing is performed: the confidence score of the corresponding clustering result in the alarm clustering result is obtained by calculating the aggregation degree in the corresponding clustering cluster, and when preferentially aggregating, the relatively high one of the classification probability and the confidence score is selected for preferential aggregation.

[0013] In a possible implementation, after the system real-time pressure feature of the target system is collected and the adjustment of the alarm convergence granularity is performed, the alarm convergence operation is automatically triggered based on the alarm aggregation result, an alarm report is generated, and the following processing is performed: the real-time alarm quantity and the system business concurrency of the target system are collected to generate the system real-time pressure feature; based on the system real-time pressure feature, alarm convergence threshold self-decision based on alarm urgency is performed on each aggregation alarm type in the alarm aggregation result, the adjustment of the alarm convergence granularity is completed, and a target convergence threshold is output; the alarm convergence operation is triggered on the alarm aggregation result based on the target convergence threshold, and the alarm report is generated.

[0014] In a possible implementation, after the hierarchical structure is generated, the following processing is further performed: a rule base constructed based on historical statistical data is used to automatically complete the context of the plurality of pieces of alarm semantic information; based on the completion result, a fault causal knowledge base is called to perform causal reasoning to generate implicit associations; and the hierarchical structure is optimized based on the implicit associations.

[0015] The application also provides a short text-oriented alarm information rapid convergence system, comprising: a semantic analysis module, configured to receive a plurality of short text alarm information sent by a target system, and perform natural language processing and semantic analysis to generate a plurality of alarm semantic information; a double-path processing module, configured to input the plurality of alarm semantic information into a double-path parallel model to perform classification and clustering processing, and generate alarm classification results and alarm clustering results, wherein the classification result of each alarm semantic information in the alarm classification results comprises an alarm classification label and a classification probability identifier; an aggregation module, configured to aggregate the alarm classification results and the alarm clustering results based on the classification probability identifier, and generate alarm aggregation results; and an alarm report generation module, configured to collect system real-time stress characteristics of the target system, adjust the alarm convergence granularity, combine the alarm aggregation results, automatically trigger an alarm convergence operation, and generate an alarm report.

[0016] The short text-oriented alarm information rapid convergence method and system provided by the application first receives a plurality of short text alarm information sent by a target system, performs natural language processing and semantic analysis to generate a plurality of alarm semantic information, then inputs the plurality of alarm semantic information into a double-path parallel model to perform classification and clustering processing, generates alarm classification results and alarm clustering results, wherein the classification result of each alarm semantic information in the alarm classification results comprises an alarm classification label and a classification probability identifier, then aggregates the alarm classification results and the alarm clustering results based on the classification probability identifier, generates alarm aggregation results, finally collects system real-time stress characteristics of the target system, adjusts the alarm convergence granularity, combines the alarm aggregation results, automatically triggers an alarm convergence operation, and generates an alarm report. The technical effect of quickly and accurately realizing alarm information convergence and improving the alarm processing efficiency of operation and maintenance personnel is achieved. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings of the embodiments of the application will be briefly introduced below. The flowchart is used to illustrate the operations performed by the system according to the embodiments of the application in the present application. It should be understood that the foregoing or the following operations are not necessarily performed in sequence. On the contrary, various steps can be processed in reverse order or simultaneously according to needs. Meanwhile, other operations can be added to these processes, or one or more steps of operations can be removed from these processes.

[0018] Figure 1 The flowchart of the short text-oriented alarm information rapid convergence method provided by the embodiments of the application.

[0019] Figure 2 The structural diagram of the short text-oriented alarm information rapid convergence system provided by the embodiments of the application.

[0020] BRIEF DESCRIPTION OF DRAWINGS Semantic analysis module 10, two-way processing module 20, aggregation module 30, alarm report generation module 40. DETAILED DESCRIPTION

[0021] The above description is only a summary of the technical solutions of the present application. In order to make the technical means of the present application more clear, the present application can be implemented according to the content of the specification, and in order to make the above and other purposes, characteristics and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described.

[0022] In order to make the purposes, technical solutions and advantages of the present application more clear, the following will combine the drawings to further describe the present application. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0023] In the following description, "some embodiments" are described, which describe a subset of all possible embodiments, but it can be understood that "some embodiments" can be the same subset or different subset of all possible embodiments, and can be combined with each other without conflict. The term "first\second" is only to distinguish similar objects, and does not represent the specific order of the object. The terms "include" and "have" and any variations, are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or modules not clearly listed or inherent to these processes, methods, products or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by those skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application.

[0024] The embodiments of the present application provide a short text-oriented alarm information fast convergence method, as shown in Figure 1 The method comprises the following steps:

[0025] Step S100, receiving a plurality of short text alarm information sent by a target system, and performing natural language processing and semantic analysis to generate a plurality of alarm semantic information.

[0026] Specifically, short text alarm information from the target system is received through a network interface such as an API interface or a message queue. For example, the alarm information is received using an HTTP request, or the alarm message is received through a message queue such as RabbitMQ. Natural language processing (NLP) is performed on the short text alarm information. NLP is a technology for processing and analyzing human language through computer technology, including word segmentation, part-of-speech tagging, named entity recognition, etc. Specifically, the short text alarm information is split into words or phrases using a word segmentation tool such as the jieba word segmentation tool. For example, “Server A memory shortage” is split into “Server A”, “memory”, and “shortage”. The part-of-speech of each word is tagged (such as noun, verb, etc.) to better understand the sentence structure. For example, “memory” is tagged as a noun and “shortage” is tagged as an adjective. Key entities in the alarm information are identified, such as device names and indicator names. For example, “Server A” is identified as a device entity. Semantic analysis is then performed, which involves understanding the meaning of the text and converting it into a semantic vector that can be understood by a computer. This includes word embedding and sentence encoding. Word embedding involves converting words or phrases into vector form for subsequent processing. For example, “memory shortage” is converted into a corresponding vector using a Word2Vec or BERT model. Sentence encoding involves encoding the entire alarm information into a semantic vector. For example, the BERT model is used to encode “Server A memory shortage” into a fixed-length vector representing the semantic information of the alarm.

[0027] For example, assume that the alarm information sent by the target system is “Server A memory shortage”. The system receives this information through an HTTP interface and then splits it into “Server A”, “memory”, and “shortage” using the jieba word segmentation tool. The entire sentence is then encoded into a semantic vector using the BERT model.

[0028] In step S200, the plurality of pieces of alarm semantic information are input into a two-path parallel model for classification and clustering processing to generate alarm classification results and alarm clustering results. The classification result for each piece of alarm semantic information in the alarm classification result includes an alarm classification label and a classification probability identifier.

[0029] Specifically, the dual-path parallel model refers to a model architecture that simultaneously uses a classification model and a clustering model to process data. The classification model is a model that classifies data into pre-set categories, i.e., uses a machine learning or deep learning model to classify alarm semantic information, outputs alarm classification labels and classification probability identifiers, where the classification probability identifier is a probability value corresponding to each category output by the classification model, used to measure the confidence of classification. For example, using a support vector machine (SVM) or deep neural network (DNN) model, the alarms are classified into categories such as "memory problem" and "disk problem". The clustering model is a model that groups data according to similarity, including a density clustering layer and a graph structure spectral clustering layer. The density clustering layer uses the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm to perform density clustering on alarm semantic vectors, i.e., clustering based on the density of data points. For example, alarms with similar semantics (such as "server A memory shortage" and "server B memory shortage") are clustered into one cluster. The graph structure spectral clustering layer constructs alarm semantic vectors into a graph structure and uses a spectral clustering algorithm for clustering. For example, a graph is constructed based on the similarity between alarms, and then similar alarms are grouped through spectral clustering.

[0030] For example, assume that the system receives two pieces of alarm information: "server A memory shortage" and "server B memory shortage". The classification model classifies both alarms as "memory problem" with classification probabilities of 0.9 and 0.85, respectively. The density clustering layer clusters the two alarms into one cluster because they are semantically similar. The graph structure spectral clustering layer further confirms this clustering result.

[0031] In one possible implementation, the plurality of pieces of alarm semantic information are input into the dual-path parallel model for classification and clustering processing to generate alarm classification results and alarm clustering results, and step S200 further includes step S210 of performing alarm type decision and classification certainty analysis on the plurality of pieces of alarm semantic information by the classification model to generate a plurality of groups of alarm classification labels and classification probability identifiers, and constructing the alarm classification results. Specifically, a deep learning model (such as BERT + full connection layer) is used to classify alarm semantic information. The model outputs the category (such as "memory problem", "network problem", etc.) to which the alarm belongs based on the input alarm semantic vector. The model not only outputs the classification result, but also outputs the probability value (classification probability identifier) of each category. For example, the model outputs the "memory problem" category with a probability of 0.95, indicating that the model has high confidence in this classification result. The classification label and classification probability identifier of each alarm are combined to form the alarm classification results.

[0032] For example, suppose the input alert semantic information is "Server A is out of memory". After being encoded by the BERT model, the classification model outputs the classification label as "memory problem" with a classification probability of 0.95. Another alert, "Server B has high network latency", is classified as "network problem" with a classification probability of 0.88.

[0033] Step S220 involves using the density clustering layer in the clustering model to cluster the several alarm semantic information entries into high-density local alarm clusters based on alarm density. Specifically, the DBSCAN algorithm is used to cluster the alarm semantic vectors. The DBSCAN algorithm identifies high-density local regions based on the density distribution of the alarm semantic vectors and clusters the alarms in these regions into a single cluster. For example, if multiple alarms are all related to "insufficient memory," they will be clustered into a high-density cluster.

[0034] For example, suppose the system receives the following alarm semantic information: "Server A is out of memory", "Server B is out of memory", "Server C has too high network latency". After processing by the density clustering layer, the first two alarms are clustered into a high-density cluster (memory problem cluster), and the third alarm becomes a separate cluster (network problem cluster).

[0035] Step S230 involves performing spectral decomposition of alarm items using a graph-structured spectral clustering layer on high-density local alarm clusters to generate a hierarchical structure. Specifically, the alarm semantic vectors in the high-density local alarm clusters are constructed into a graph structure, where nodes represent alarms and edge weights represent the similarity between alarms. A spectral clustering algorithm is used to decompose the graph structure, further refining the alarm clusters and generating a hierarchical structure. For example, a high-density cluster is further decomposed into multiple subclasses. The final clustering result is hierarchical, with each high-density cluster containing multiple subclasses, and the subclasses having finer-grained distinctions between them.

[0036] For example, suppose the "memory problem cluster" contains the following alerts: "Server A is out of memory", "Server B is out of memory", and "Server C has high memory usage". After processing by the graph structure spectral clustering layer, the "memory problem cluster" is further decomposed into two subclasses: Subclass 1: Insufficient memory (including alerts from Server A and Server B) and Subclass 2: High memory usage (including alerts from Server C).

[0037] Step S240: Generate the alarm clustering results using the hierarchical structure. Specifically, the hierarchical structure generated by spectral clustering is integrated into the final alarm clustering results, with each alarm assigned to a corresponding cluster and subclass, forming a clear clustering result.

[0038] For example, the final alarm clustering results are as follows: Memory problem cluster: Subclass 1: Insufficient memory (Server A, Server B), Subclass 2: Excessive memory usage (Server C); Network problem cluster: Subclass 1: Excessive network latency (Server C).

[0039] This implementation uses a deep learning model for classification, and combines density clustering and spectral clustering algorithms for fine-grained hierarchical clustering. This enables more accurate and efficient processing of alarm information, not only improving the accuracy of alarm classification, but also providing more detailed alarm analysis through hierarchical clustering.

[0040] In one possible implementation, a hierarchical structure is generated by performing spectral decomposition of alarm items using a graph-structured spectral clustering layer with high-density local alarm clusters. Step S230 further includes step S231, constructing a similarity graph between alarm items using a graph-structured spectral clustering layer with high-density local alarm clusters. Specifically, the similarity graph is a similarity matrix based on semantic similarity, temporal proximity, and IP / node affiliation consistency. The cosine similarity or Euclidean distance between alarm semantic vectors is calculated to measure the semantic relevance of the alarm content. For example, two alarms, "Server A is out of memory" and "Server B is out of memory," have high semantic similarity. The difference in alarm occurrence time is calculated; the closer the times, the higher the similarity. For example, two alarms occurring on the same day have a high temporal proximity score. The similarity is increased if the alarms originate from the same IP address or the same node. For example, two alarms originating from Server A have a high IP affiliation consistency score. The above three similarities are combined to construct a similarity matrix, where each element of the matrix represents the combined similarity between two alarms.

[0041] For example, suppose there are the following alarms: Alarm 1: Server A is out of memory (Time: 10:00); Alarm 2: Server A is out of memory (Time: 10:05); Alarm 3: Server B has high network latency (Time: 10:10). The similarity matrix is ​​shown in Table 1.

[0042] Table 1: Example of a similarity matrix

[0043] Alert Alert 1 Alert 2 Alert 3 Alert 1 1.00 0.95 0.20 Alert 2 0.95 1.00 0.25 Alert 3 0.20 0.25 1.00

[0044] Step S232: Perform spectral decomposition on the similarity map to obtain eigenvalues ​​and eigenvectors. Specifically, use mathematical tools (such as NumPy) to perform spectral decomposition (eigenvalue decomposition) on the similarity matrix to obtain eigenvalues ​​and eigenvectors. Spectral decomposition is the process of decomposing a matrix into eigenvalues ​​and eigenvectors. Eigenvalues ​​represent the "importance" or "energy" of the matrix, and eigenvectors represent the "direction" of the matrix. For example, suppose the eigenvalues ​​of the similarity matrix are λ1 = 2.0, λ2 = 0.5, and λ3 = 0.1, and the corresponding eigenvectors are v1, v2, and v3, respectively.

[0045] Step S233: Based on the eigenvalues ​​and eigenvectors, select the k smallest eigenvectors, where k is the index corresponding to the point with the largest difference between adjacent eigenvalues ​​after arranging the eigenvalues ​​in ascending order during spectral decomposition. Specifically, sort the eigenvalues ​​in ascending order, find the point with the largest difference between adjacent eigenvalues, and determine the value of k. For example, if the eigenvalues ​​are sorted as λ3 = 0.1, λ2 = 0.5, λ1 = 2.0, with differences of 0.4 and 1.5 respectively, then k = 2 is selected because the point with the largest difference is between λ2 and λ1. Select the k smallest eigenvectors as input for subsequent clustering. For example, based on the above eigenvalues, k = 2 is selected, and eigenvectors v2 and v3 are extracted as input for subsequent clustering.

[0046] Step S234: The k feature vectors are used as update feature inputs for clustering to obtain the hierarchical structure. Specifically, a traditional clustering algorithm (such as K-means) is used to cluster the extracted feature vectors, and a hierarchical structure is generated based on the clustering results. Each cluster can be further divided into sub-clusters to form a hierarchical clustering result.

[0047] For example, suppose that the extracted feature vectors v2 and v3 are clustered by K-means and the following hierarchical structure is obtained: Main class 1: memory problem, subclass 1: insufficient memory of server A (alarm 1, alarm 2); Main class 2: network problem, subclass 1: excessive network latency of server B (alarm 3).

[0048] This implementation combines semantic similarity, temporal proximity, and IP / node affiliation consistency to more comprehensively assess the correlation between alarms. For example, even if two alarms are semantically similar, their overall similarity will be low if they originate from different nodes and are geographically distant. This avoids the limitations of single-dimensional similarity assessment and improves the accuracy and reliability of clustering. Spectral decomposition can extract the inherent structure of data. Through eigenvalues ​​and eigenvectors, it can better understand the distribution and clustering trends of alarm data. Compared to traditional clustering methods, spectral clustering can better handle complex data distributions, especially non-convex clusters. Selecting the k-value through the difference of eigenvalues ​​avoids the problem of manually setting the number of clusters, making the clustering process more automated and improving its flexibility and adaptability. It can dynamically adjust the granularity of clustering according to the actual data situation. Generating a hierarchical structure through spectral clustering not only identifies the major categories of alarms but also further distinguishes the specific problems of alarms, providing more detailed alarm analysis and helping operations personnel quickly locate the root cause of problems.

[0049] In one possible implementation, after generating the hierarchical structure, step S200 further includes step S250, which uses a rule base built based on historical statistical data to automatically complete the context of the several alarm semantic information entries. Specifically, historical alarm data is analyzed to statistically analyze common alarm patterns and relationships. For example, it is determined which alarms are typically associated with specific modules or business lines. A rule base is generated based on the statistical results. For example, if historical data shows that "insufficient memory" alarms are typically associated with the "database module," then the rule is generated: "Insufficient memory" → "Source module: Database module."

[0050] For each alarm semantic information, missing fields are completed based on the rule base. For example, if an alarm "insufficient memory" is missing the "source module" field, it is completed to "source module: database module" based on the rule base.

[0051] For uncertain fields, probabilistic statistical methods are used for estimation. For example, if an alarm is related to multiple modules, estimations are made based on the frequency of occurrence of each module in historical data.

[0052] For example, suppose there are the following alarms: Alarm 1: Insufficient memory (missing field: source module), Alarm 2: High network latency (missing field: business line). The rule base contains the following rules: "Insufficient memory" → "Source module: Database module"; "High network latency" → "Business line: E-commerce". After context auto-completion, the alarm information becomes: Alarm 1: Insufficient memory (Source module: Database module), Alarm 2: High network latency (Business line: E-commerce).

[0053] Step S260: Based on the completion result, the fault causal knowledge base is invoked to perform causal reasoning and generate implicit associations. Specifically, a fault causal knowledge base is constructed based on historical fault data and expert experience. The knowledge base contains causal relationships between alarms. For example, "insufficient memory" may lead to "application crash". A reasoning engine (such as a rule-based reasoning engine or graph neural network) is used to perform causal reasoning on the completed alarm information. Based on the causal relationships in the knowledge base, implicit associations between alarms are derived. For example, if there is a causal relationship between alarm 1 (insufficient memory) and alarm 2 (application crash), an implicit association is generated and marked in the alarm information for subsequent processing.

[0054] For example, suppose the completed alarm information is: Alarm 1: Insufficient memory (Source module: Database module), Alarm 2: Application crash (Business line: E-commerce). The fault causal knowledge base contains the following causal relationship: "Insufficient memory" → "May cause" → "Application crash". After causal reasoning, an implicit association is generated: Alarm 1 (Insufficient memory) → Causes → Alarm 2 (Application crash).

[0055] Step S270: Optimize the hierarchical structure based on the implicit relationships. Specifically, according to the implicit relationships, related alarms are further integrated into the same subclass or cluster. For example, if alarm 1 and alarm 2 have a causal relationship, they are grouped into the same subclass. Adjust the hierarchical structure to make the organization of alarms more reasonable. For example, alarms with close causal relationships are placed at the same level for easier analysis and processing. Evaluate the optimized hierarchical structure using clustering quality assessment metrics (such as silhouette coefficient, Davies-Bouldin index), and further adjust the hierarchical structure based on the evaluation results until the optimal effect is achieved.

[0056] For example, suppose the unoptimized hierarchical structure is: Main class 1: Memory problem, Subclass 1: Insufficient memory (Alert 1); Main class 2: Application problem, Subclass 1: Application crash (Alert 2). Based on the implicit association (Alert 1 → leading to → Alert 2), the optimized hierarchical structure is: Main class 1: Memory problem, Subclass 1: Insufficient memory (Alert 1), Subclass 2: Application crash (Alert 2).

[0057] This implementation automatically completes missing fields through a rule base, making alarm information more complete, reducing misjudgments caused by missing information, and improving the efficiency and accuracy of alarm processing. Adjusting the hierarchical structure based on implicit relationships makes alarm organization more rational, improving the readability and usability of the hierarchical structure, and facilitating rapid alarm analysis and processing by operations and maintenance personnel.

[0058] Step S300: Based on the classification probability identifier, aggregate the alarm classification result and the alarm clustering result to generate an alarm aggregation result.

[0059] Specifically, the classification and clustering results are weighted and aggregated based on classification probabilities. For example, if the classification probability is high (e.g., greater than 0.8), the classification result is used; if the classification probability is low, the clustering result is referenced. The classification and clustering results are then integrated according to preset rules. For instance, assuming the classification probability of "Server A is low on memory" is 0.9, and the clustering results show it is similar to other memory problem alerts, the system, based on a weighted aggregation algorithm, ultimately aggregates this alert into the "memory problem" category and marks it as high confidence.

[0060] In one possible implementation, based on the classification probability identifier, the alarm classification results and the alarm clustering results are aggregated to generate an alarm aggregation result. Step S300 further includes step S310, which, based on the classification probability identifier, identifies a first classification subset of alarm classification results with a probability less than a first probability threshold. This first classification subset is an uncertain classification subset. Specifically, a threshold (e.g., 0.5) is determined experimentally to distinguish the reliability of the classification results. Alarms with a classification probability less than the first threshold are filtered out; the classification results of these alarms are not sufficiently uncertain and are classified into the "first classification subset".

[0061] For example, assuming the classification probability threshold is set to 0.5, the alarm classification results are as follows: Alarm 1: Classification label is "Memory problem", classification probability is 0.4 (less than 0.5); Alarm 2: Classification label is "Network problem", classification probability is 0.6 (greater than 0.5). Then, Alarm 1 is identified as the first classification subset (uncertain classification subset).

[0062] Step S320: Aggregate the first category subset using the alarm clustering results to generate a first aggregation result. Specifically, for alarms in the first category subset, since their classification results are not sufficiently certain, the alarm clustering results are directly used for aggregation. The alarms in the first category subset are categorized according to the clustering results to form the first aggregation result.

[0063] For example, suppose the first category subset contains the following alarms: Alarm 1: the classification probability is 0.4, and the clustering result belongs to the "memory problem cluster", then the first aggregation result is: memory problem cluster: alarm 1.

[0064] Step S330: Based on the classification probability identifier, identify a second classification subset in the alarm classification results whose probability is greater than a first probability threshold and less than a second probability threshold. Compare the confidence scores of the corresponding clustering results in the classification probability identifier and alarm clustering results for priority aggregation to generate a second aggregation result. Specifically, determine a higher threshold (e.g., 0.8) to distinguish high-confidence classification results. Filter out alarms whose classification probabilities are between the first and second thresholds; these alarms have some reliability, but are not entirely trustworthy. Compare the confidence scores of the classification probabilities and clustering results (e.g., cluster density scores), and prioritize aggregation of results with higher confidence. Based on the comparison results, classify the alarms in the second classification subset to form the second aggregation result.

[0065] For example, assuming the first probability threshold is 0.5 and the second probability threshold is 0.8, the alarm classification results are as follows: Alarm 2: Classification label is "Network Problem", classification probability is 0.6 (between 0.5 and 0.8); Alarm 3: Classification label is "Disk Problem", classification probability is 0.7 (between 0.5 and 0.8). Assume the clustering confidence scores are: Alarm 2: Clustering result is "Network Problem Cluster", clustering confidence is 0.7; Alarm 3: Clustering result is "Memory Problem Cluster", clustering confidence is 0.6. After comparison, the clustering confidence of Alarm 2 is higher than the classification probability, so the clustering result is adopted first; the classification probability of Alarm 3 is higher than the clustering confidence, so the classification result is adopted first. Therefore, the second aggregation result is: Network Problem Cluster: Alarm 2; Disk Problem Cluster: Alarm 3.

[0066] Step S340: Based on the classification probability identifier, identify a third category subset of alarm classification results whose probability is greater than the second probability threshold, and aggregate them using alarm classification labels to generate a third aggregation result. Specifically, alarms with a classification probability greater than the second threshold are selected, as these alarms have high classification reliability. The classification labels are then directly used to aggregate and classify the alarms in the third category subset to form the third aggregation result.

[0067] For example, assuming the second probability threshold is 0.8, the alarm classification results are as follows: Alarm 4: the classification label is "memory problem", and the classification probability is 0.9 (greater than 0.8). Then the third aggregation result is: memory problem cluster: alarm 4.

[0068] Step S350: Generate the alarm aggregation result using the first aggregation result, the second aggregation result, and the third aggregation result. Specifically, merge the first aggregation result, the second aggregation result, and the third aggregation result to form and output the final alarm aggregation result, which includes the classification and clustering information of all alarms.

[0069] For example, the final alarm aggregation result is: memory problem cluster: alarm 1, alarm 4, network problem cluster: alarm 2, disk problem cluster: alarm 3.

[0070] This implementation divides alarm classification results into three subsets by setting two probability thresholds, each corresponding to a different level of reliability. This avoids applying a single aggregation strategy to all alarms, improving the flexibility and accuracy of aggregation. For alarms with low classification probabilities (the first subset), clustering results are used directly for aggregation, fully leveraging the advantages of clustering algorithms. When classification results are unreliable, clustering provides valuable supplementation and reduces misjudgments. For alarms with medium classification probabilities (the second subset), classification probabilities and clustering confidence scores are compared, prioritizing the aggregation of more reliable results. The aggregation strategy is dynamically selected based on specific circumstances, further improving the reliability of the aggregation results. For alarms with high classification probabilities (the third subset), aggregation is performed directly by classification label, avoiding unnecessary calculations, improving processing efficiency, and ensuring the accuracy of high-confidence alarms. The final alarm aggregation result combines the advantages of classification and clustering, considering both classification confidence and clustering structural information. The generated alarm aggregation result is more accurate and reliable, facilitating quick understanding and processing of alarm information by operations and maintenance personnel.

[0071] In one possible implementation, step S330 further includes step S331, where the confidence score of the corresponding clustering result in the alarm clustering result is obtained by calculating the clustering degree within the corresponding cluster. During priority aggregation, the clustering is prioritized based on the higher of the classification probability and the confidence score. Specifically, the clustering degree is the ratio of the number of alarms within a cluster to the total number of alarms, calculated as: Clustering degree = Number of alarms within the cluster / Total number of alarms. The number of alarms within each cluster is counted and then divided by the total number of alarms to obtain the clustering degree for each cluster. The clustering degree is used as the confidence score of the clustering result; a higher clustering degree indicates a more concentrated cluster of alarms and higher confidence. For each alarm, its classification probability and corresponding clustering confidence score are compared, and the clustering is prioritized based on the higher of the classification probability and the higher the confidence score.

[0072] This implementation quantifies the reliability of clustering results by calculating the clustering degree within each cluster. Higher clustering degree indicates a more concentrated set of alerts within the cluster, thus increasing reliability. It provides an objective evaluation method, avoiding subjective judgment and making the assessment of clustering result reliability more scientific.

[0073] Step S400: Collect the real-time pressure characteristics of the target system, adjust the alarm convergence granularity, and automatically trigger the alarm convergence operation based on the alarm aggregation results to generate an alarm report.

[0074] Specifically, monitoring tools (such as Prometheus) are used to collect real-time stress characteristics of the target system, such as CPU utilization and memory utilization. Key features, such as average CPU utilization and peak memory usage, are extracted from the monitoring data. The granularity of alarm convergence is dynamically adjusted based on the system stress characteristics. Alarm convergence granularity refers to the level of detail in alarm merging; finer granularity results in more detailed merged alarms, while coarser granularity results in more coarse merged alarms. For example, if system stress is high (e.g., CPU utilization exceeds 80%), the alarm convergence threshold is lowered to reduce the number of alarms. Alarms are merged according to preset strategies. For example, if alarms of the same category occur multiple times within a short period, they are merged into a single alarm. Alarm convergence operations are automatically triggered using preset report templates via automated scripts or workflow engines (such as Ansible), generating alarm reports. These reports include information such as alarm category, number of alarms, and affected devices.

[0075] For example, assuming system stress characteristics show that CPU utilization exceeds 80%, the system automatically adjusts the alarm convergence granularity to a more lenient threshold. For alarms in the "memory problem" category, the system merges multiple alarms occurring within a short period into one alarm and generates an alarm report. The report includes information such as the alarm category being "memory problem," the number of alarms being 10, and the affected devices being server A and server B.

[0076] In one possible implementation, the real-time stress characteristics of the target system are collected, and after adjusting the alarm convergence granularity, the alarm convergence operation is automatically triggered based on the alarm aggregation results to generate an alarm report. Step S400 further includes step S410, collecting the real-time alarm volume and system service concurrency of the target system to generate the real-time stress characteristics of the system. Specifically, monitoring tools (such as Prometheus, Zabbix) are used to collect the current alarm volume of the system in real time. For example, the number of currently active alarms is counted every minute. The current system service concurrency is collected through system performance monitoring tools (such as APM tools). For example, the number of transactions processed per second or the number of currently online users is counted. The real-time alarm volume and system service concurrency are combined into a feature vector. For example, the feature vector can be represented as [real-time alarm volume, system service concurrency]. Assuming that the current real-time alarm volume of the system is 50 alarms / minute and the system service concurrency is 1000 times / second, the real-time stress characteristics of the system are [50, 1000].

[0077] Step S430: Based on the real-time system pressure characteristics, perform a self-decision-making process for alarm convergence thresholds based on alarm urgency for each aggregated alarm type in the alarm aggregation result, thereby adjusting the alarm convergence granularity and outputting a target convergence threshold. Specifically, an urgency level is defined for each alarm type according to its type, impact range, and historical data. For example, the urgency level for "Insufficient Memory" alarms is 0.8, and the urgency level for "Network Latency" alarms is 0.5. The convergence threshold for each alarm type is dynamically adjusted based on the real-time system pressure characteristics. For example, when system pressure is high (e.g., alarm volume > 100 alarms / minute), the convergence threshold is relaxed to allow more alarms to be merged. When system pressure is low (e.g., alarm volume < 50 alarms / minute), the convergence threshold is tightened to reduce redundant alarms. A target convergence threshold is generated for each alarm type. For example, for "Insufficient Memory" alarms, the target convergence threshold is 10 alarms / 10 minutes; for "Network Latency" alarms, the target convergence threshold is 5 alarms / 10 minutes.

[0078] Step S430: Trigger an alarm convergence operation on the alarm aggregation result using the target convergence threshold to generate the alarm report. Specifically, according to the target convergence threshold, alarms of each alarm type are merged. For example, if there are 12 "insufficient memory" alarms within 10 minutes, they are merged into 10 alarms. If there are 3 "network latency" alarms within 10 minutes, 3 alarms are retained. The merged alarm information is used to generate an alarm report, which includes information such as alarm type, number of alarms, and scope of impact.

[0079] This implementation dynamically adjusts the alarm convergence granularity based on the system's real-time pressure characteristics, adapting to different system load conditions. When system pressure is high, it reduces the number of alarms to avoid alarm overload; when system pressure is low, it provides more detailed alarm information. An urgency level is defined for each alarm type, and the convergence threshold is dynamically adjusted based on the urgency level, prioritizing high-urgency alarms and improving the efficiency and targeting of alarm handling.

[0080] This application employs natural language processing and semantic analysis techniques to preprocess alarm information, generating alarm semantic information. Simultaneously, a dual-parallel model is used to classify and cluster the alarm semantic information, and the results are aggregated based on classification probability labels. Combined with techniques such as adjusting the alarm convergence granularity according to real-time system pressure characteristics, this solves the technical problem of inaccurate alarm convergence in existing short-text alarm information processing, which leads to low efficiency in alarm handling by maintenance personnel. It achieves the technical effect of quickly and accurately converging alarm information and improving the efficiency of alarm handling by maintenance personnel.

[0081] In the above text, refer to Figure 1 A method for rapid convergence of alarm information based on short text, according to an embodiment of the present invention, is described in detail. Next, reference will be made to...Figure 2 A fast alarm information convergence system for short texts according to an embodiment of the present invention is described.

[0082] The alarm information rapid convergence system for short text according to embodiments of the present invention addresses the technical problem of inaccurate alarm convergence in existing short text alarm information processing, which leads to low efficiency in alarm handling by maintenance personnel. The system achieves rapid and accurate alarm information convergence, thereby improving the efficiency of alarm handling by maintenance personnel. The short text alarm information rapid convergence system includes: a semantic analysis module 10, a dual-processing module 20, an aggregation module 30, and an alarm report generation module 40.

[0083] The semantic analysis module 10 receives several short text alarm messages from the target system and performs natural language processing and semantic analysis to generate several alarm semantic messages. The dual-processing module 20 inputs the alarm semantic messages into a dual-parallel model for classification and clustering to generate alarm classification results and alarm clustering results. The classification results for each alarm semantic message include an alarm classification label and a classification probability identifier. The aggregation module 30 aggregates the alarm classification results and the alarm clustering results based on the classification probability identifier to generate an alarm aggregation result. The alarm report generation module 40 collects the real-time system stress characteristics of the target system, adjusts the alarm convergence granularity, and automatically triggers alarm convergence operation based on the alarm aggregation result to generate an alarm report.

[0084] The specific configuration of the dual-processing module 20 will be described in detail below. As mentioned above, the dual-processing module 20 may further include: a dual-parallel model building unit for building a dual-parallel model, wherein the dual-parallel model includes a classification model and a clustering model, and the clustering model includes a density clustering layer and a graph structure spectrum clustering layer.

[0085] The process involves inputting the aforementioned alarm semantic information into a dual-path parallel model for classification and clustering, generating alarm classification results and alarm clustering results. The dual-path processing module 20 may further include: an alarm classification result construction unit for performing alarm type decision-making and classification deterministic analysis on the aforementioned alarm semantic information using the classification model, generating several sets of alarm classification labels and classification probability identifiers, and constructing the alarm classification results; a high-density local alarm cluster acquisition unit for clustering the aforementioned alarm semantic information into high-density local alarm clusters based on alarm density using the density clustering layer in the clustering model; a spectral decomposition unit for performing spectral decomposition of alarm items using the high-density local alarm clusters through a graph structure spectral clustering layer, generating a hierarchical structure; and an alarm clustering result generation unit for generating the alarm clustering results using the hierarchical structure.

[0086] Specifically, a hierarchical structure is generated by performing spectral decomposition of alarm items using a graph-structured spectral clustering layer with high-density local alarm clusters. The spectral decomposition unit may further include: a similarity graph construction subunit for constructing a similarity graph between alarm items using a graph-structured spectral clustering layer with high-density local alarm clusters; a spectral decomposition subunit for performing spectral decomposition on the similarity graph to obtain eigenvalues ​​and eigenvectors; a selection subunit for selecting the k smallest eigenvectors based on the eigenvalues ​​and eigenvectors, where k is the index corresponding to the point with the largest difference between adjacent eigenvalues ​​after arranging the eigenvalues ​​in ascending order during the spectral decomposition process; and a clustering subunit for using the k eigenvectors as update feature inputs to perform clustering to obtain the hierarchical structure.

[0087] The similarity graph construction subunit may further include: the similarity graph is a similarity matrix based on semantic similarity, temporal proximity, and IP / node affiliation consistency.

[0088] The specific configuration of the aggregation module 30 will be described in detail below. As described above, based on the classification probability identifier, the alarm classification results and the alarm clustering results are aggregated to generate an alarm aggregation result. The aggregation module 30 may further include: a first classification subset identification unit, used to identify a first classification subset in the alarm classification results with a probability less than a first probability threshold based on the classification probability identifier, wherein the first classification subset is an uncertain classification subset; a first classification subset aggregation unit, used to aggregate the first classification subset with the alarm clustering results to generate a first aggregation result; a second aggregation result generation unit, used to identify a second classification subset in the alarm classification results with a probability greater than the first probability threshold and less than a second probability threshold based on the classification probability identifier, and to perform priority aggregation by comparing the confidence scores of the corresponding clustering results in the classification probability identifier and the alarm clustering results to generate a second aggregation result; a third aggregation result generation unit, used to identify a third classification subset in the alarm classification results with a probability greater than the second probability threshold based on the classification probability identifier, and to perform aggregation using alarm classification labels to generate a third aggregation result; and an alarm aggregation result generation unit, used to generate the alarm aggregation result with the first aggregation result, the second aggregation result, and the third aggregation result.

[0089] The second aggregation result generation unit may further include: the credibility score of the corresponding clustering result in the alarm clustering result is obtained by calculating the aggregation degree within the corresponding cluster, and when prioritizing aggregation, the one with the higher classification probability and credibility score is selected for priority aggregation.

[0090] The specific configuration of the alarm report generation module 40 will be described in detail below. As mentioned above, after collecting the real-time system pressure characteristics of the target system and adjusting the alarm convergence granularity, the alarm convergence operation is automatically triggered in conjunction with the alarm aggregation results to generate an alarm report. The alarm report generation module 40 may further include: a system real-time pressure characteristic generation unit for collecting the real-time alarm volume and system service concurrency of the target system to generate the system real-time pressure characteristics; an alarm convergence threshold self-decision unit for performing alarm convergence threshold self-decision based on alarm urgency for each aggregated alarm type in the alarm aggregation results based on the system real-time pressure characteristics, completing the adjustment of the alarm convergence granularity, and outputting a target convergence threshold; and an alarm convergence unit for triggering an alarm convergence operation on the alarm aggregation results with the target convergence threshold to generate the alarm report.

[0091] After generating the hierarchical structure, the dual-processing module 20 may further include: a context auto-completion unit for automatically completing the context of the several alarm semantic information using a rule base built based on historical statistical data; a causal reasoning unit for performing causal reasoning based on the completion result by calling a fault causal knowledge base to generate implicit associations; and an optimization unit for optimizing the hierarchical structure with the implicit associations.

[0092] The alarm information fast convergence system for short text provided in this embodiment of the invention can execute the alarm information fast convergence method for short text provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0093] Although this application makes various references to certain modules in the system according to the embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy distinction between each other and are not used to limit the scope of protection of this invention.

[0094] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application. In some cases, the actions or steps described in this application can be performed in a different order than that shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A method for rapid convergence of alarm information based on short text, characterized in that, include: Receive several short text alarm messages from the target system, perform natural language processing and semantic analysis, and generate several alarm semantic messages; The aforementioned alarm semantic information is input into a dual-path parallel model to perform alarm classification based on classification probability and alarm clustering processing based on fusion density and graph structure, generating alarm classification results and alarm clustering results. The classification results for each alarm semantic information in the alarm classification results include alarm classification labels and classification probability identifiers. Based on the classification probability identifier, the alarm classification results and the alarm clustering results are compared in terms of credibility and aggregated priority is selected to generate alarm aggregation results; The aggregation priority selection based on the classification probability identifier, which compares the credibility of the alarm classification results and the alarm clustering results, to generate alarm aggregation results includes: Based on the classification probability identifier, a first classification subset with a probability less than a first probability threshold is identified in the alarm classification results. The first classification subset is an uncertain classification subset. The first category subset is aggregated using the alarm clustering results to generate a first aggregation result; Based on the classification probability identifier, a second classification subset with a probability greater than the first probability threshold and less than the second probability threshold is identified in the alarm classification results. The confidence scores of the corresponding clustering results in the alarm clustering results are compared and aggregated first to generate a second aggregation result. Based on the classification probability identifier, a third category subset with a probability greater than the second probability threshold is identified in the alarm classification results, and aggregated using alarm classification labels to generate a third aggregation result. The alarm aggregation result is generated using the first aggregation result, the second aggregation result, and the third aggregation result; The system collects real-time pressure characteristics of the target system, adjusts the alarm convergence granularity, and automatically triggers alarm convergence operation based on the alarm aggregation results to generate an alarm report.

2. The method for rapid convergence of alarm information based on short text as described in claim 1, characterized in that, The dual-path parallel model includes a classification model and a clustering model, and the clustering model includes a density clustering layer and a graph structure spectrum clustering layer.

3. The method for rapid convergence of alarm information for short texts as described in claim 2, characterized in that, The aforementioned alarm semantic information is input into a dual-path parallel model for alarm classification based on classification probability and alarm clustering processing that integrates density and graph structure, generating alarm classification results and alarm clustering results, including: The classification model is used to perform alarm type decision-making and classification deterministic analysis on the several alarm semantic information, generate several sets of alarm classification labels and classification probability identifiers, and construct the alarm classification result; The density clustering layer in the clustering model is used to cluster the several alarm semantic information into high-density local alarm clusters based on alarm density. A hierarchical structure is generated by performing spectral decomposition of alarm terms using a graph-structured spectral clustering layer with high-density local alarm clusters. The alarm clustering results are generated using the hierarchical structure.

4. The method for rapid convergence of alarm information for short texts as described in claim 3, characterized in that, A hierarchical structure is generated by performing spectral decomposition of alarm terms using a graph-structured spectral clustering layer with high-density local alarm clusters, including: A similarity graph between alarm items is constructed using a graph-structured spectral clustering layer to create high-density local alarm clusters. Spectral decomposition is performed on the similarity map to obtain eigenvalues ​​and eigenvectors; Based on the eigenvalues ​​and eigenvectors, select the k smallest eigenvectors; The k feature vectors are used as update feature inputs for clustering to obtain the hierarchical structure. Where k is the index of the point with the largest difference between adjacent eigenvalues ​​obtained after arranging the eigenvalues ​​in ascending order during the spectral decomposition process.

5. The method for rapid convergence of alarm information for short texts as described in claim 4, characterized in that, The similarity graph is a similarity matrix based on semantic similarity, temporal proximity, and IP / node affiliation consistency.

6. The method for rapid convergence of alarm information for short texts as described in claim 1, characterized in that, The credibility score of the corresponding cluster in the alarm clustering results is obtained by calculating the clustering degree within the corresponding cluster. When prioritizing aggregation, the one with the higher classification probability and credibility score is selected for priority aggregation.

7. The method for rapid convergence of alarm information for short texts as described in claim 1, characterized in that, After collecting the real-time system pressure characteristics of the target system and adjusting the alarm convergence granularity, the alarm convergence operation is automatically triggered based on the alarm aggregation results, generating an alarm report, including: Collect the real-time alarm volume and system service concurrency of the target system to generate the real-time pressure characteristics of the system; Based on the real-time pressure characteristics of the system, the alarm convergence threshold of each aggregated alarm type in the alarm aggregation result is self-determined based on the alarm urgency, thereby adjusting the alarm convergence granularity and outputting the target convergence threshold. The alarm convergence operation is triggered on the alarm aggregation result using the target convergence threshold, and the alarm report is generated.

8. The method for rapid convergence of alarm information for short texts as described in claim 4, characterized in that, After generating the hierarchical structure, it also includes: A rule base built based on historical statistical data is used to automatically complete the context of the aforementioned alarm semantic information; Based on the completion results, the fault causal knowledge base is invoked to perform causal reasoning and generate implicit associations. The hierarchical structure is optimized based on the implicit associations.

9. A rapid convergence system for alarm information based on short text, characterized in that, The system is used to implement the method for rapid convergence of alarm information oriented towards short text as described in any one of claims 1-8, and the system comprises: The semantic analysis module is used to receive several short text alarm messages issued by the target system, and perform natural language processing and semantic analysis to generate several alarm semantic messages. The dual-processing module is used to input the several alarm semantic information into the dual-parallel model to perform alarm classification based on classification probability and alarm clustering processing based on fusion density and graph structure, and generate alarm classification results and alarm clustering results. The classification result for each alarm semantic information in the alarm classification result includes alarm classification label and classification probability identifier. The aggregation module is used to perform a confidence comparison of the alarm classification results and the alarm clustering results based on the classification probability identifier, and generate an alarm aggregation result. The alarm report generation module is used to collect the real-time system pressure characteristics of the target system, adjust the alarm convergence granularity, and automatically trigger the alarm convergence operation in combination with the alarm aggregation results to generate an alarm report.

Images