Alarm event prediction model training method and device and dynamic environment monitoring system
By defining the observation window and prediction window in the power environment monitoring system, labeling samples, extracting features, and training the XGBoost model using multi-instance learning and oversampling techniques, the problem of insufficient timeliness of alarm events is solved, achieving the effect of early prediction and loss reduction.
Patent Information
- Application Number
- CN202511109652.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-08
- Publication Date
- 2025-11-14
AI Technical Summary
In existing power and environmental monitoring systems, the timeliness of alarm events is insufficient, leading to economic losses and reduced operational stability.
By defining observation and prediction windows, labeling positive and negative samples, extracting features from training data, and employing multi-instance learning and oversampling techniques, the XGBoost model is trained to predict future alarm events.
Predict alarm events in advance to reduce economic losses and improve the stability of data center equipment operation and overall maintenance quality.
Smart Images
Figure CN120951154A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing technology, and in particular to a method, apparatus and power environment monitoring system for training an alarm event prediction model. Background Technology
[0002] The power and environmental monitoring system can monitor the indicators and abnormal status of basic environmental facilities in real time, and provide alarm event information for operation and maintenance engineers. It is of great significance for ensuring the stable operation of power distribution, HVAC and other environments in data center computer rooms.
[0003] However, some alarm events can severely reduce system availability and have a huge impact on data center operations. By the time an alarm event is reported to the operations and maintenance engineer, it may have already caused significant economic losses and affected the overall stability of operations and maintenance. Summary of the Invention
[0004] In view of this, this application provides a method, device and power environment monitoring system for training alarm event prediction models, which aims to reduce economic losses and improve the overall stability of operation and maintenance by providing early warnings.
[0005] Firstly, this application provides a method for training an alarm event prediction model, the method comprising:
[0006] Determine the size of the observation window and the prediction window corresponding to the observation window after a first time interval. Based on whether an alarm event occurs in the prediction window, mark the observation window corresponding to the prediction window as positive and negative samples.
[0007] Extract alarm data and monitoring data from multiple observation windows in the training data;
[0008] Noise reduction is performed on alarm data from multiple observation windows through multi-instance learning;
[0009] The training set is formed by balancing the data volume of the observation windows for positive samples and negative samples through oversampling;
[0010] The training set is used to train the classification model to obtain the trained classification model, which is then used to classify the observation window and predict whether an alarm event will occur in the corresponding prediction window.
[0011] Optionally, the first duration is greater than or equal to the minimum duration required to process the alarm.
[0012] Optionally, the extraction of alarm data and monitoring data from multiple observation windows in the training data includes:
[0013] Extract alarm data text features, alarm data statistical features, and monitoring data from multiple observation windows in the training data. The monitoring data includes normal monitoring indicators and alarm indicators.
[0014] Optionally, extract the text features of the alarm data from the multiple observation windows, including:
[0015] A K-dimensional text feature vector is generated for each observation window. Each element in the text feature vector represents the probability of the corresponding topic. The topic is characterized by the distribution of words in the alarm data text content of the observation window. The number of times the words appear in the text content reaches a preset condition.
[0016] Optionally, extract statistical features of the alarm data from the multiple observation windows, including:
[0017] Extract the alarm count, window time, and arrival interval for each observation window; wherein, the alarm count includes one or more of the total number of alarms in the observation window, the number of alarms of different severity levels, and the number of alarms of different types; the window time is the time characteristic data of the observation window; and the arrival interval is the average time interval between consecutive alarms within the observation window.
[0018] Optionally, the noise reduction processing of alarm data from multiple observation windows through multi-instance learning includes:
[0019] Identify the multiple instance windows included in each observation window, and extract features from each instance window;
[0020] Configuring weights for the multiple instance windows, wherein the more meaningless alarms are included in the extracted features of an instance window, the lower the configured weight;
[0021] Based on the weights configured for each instance window, the features extracted from the multiple instance windows are aggregated into the features of a single package, which is then used as the features of the observation window.
[0022] Optionally, the step of marking the observation window corresponding to the prediction window as positive and negative samples based on whether an alarm event occurs in the prediction window includes: if an alarm event occurs in the prediction window, the observation window corresponding to the prediction window is marked as a positive sample; if no alarm event occurs in the prediction window, the observation window corresponding to the prediction window is marked as a negative sample.
[0023] The method of balancing the observation window of positive samples and the observation window of negative samples through oversampling includes generating synthetic samples as positive samples using the K-nearest neighbor algorithm.
[0024] Optionally, the classification model is the XGBoost model.
[0025] Secondly, this application provides a training apparatus for an alarm event prediction model, the apparatus comprising:
[0026] The setting unit is used to determine the size of the observation window and the prediction window corresponding to the observation window after a first time interval, and to mark the observation window corresponding to the prediction window as positive and negative samples according to whether an alarm event occurs in the prediction window.
[0027] The extraction unit is used to extract alarm data and monitoring data from multiple observation windows in the training data;
[0028] The noise reduction unit is used to perform noise reduction processing on alarm data from multiple observation windows through multi-instance learning;
[0029] The oversampling unit is used to balance the amount of data in the observation windows of positive samples and negative samples through oversampling, thus forming a training set;
[0030] The training unit is used to train a classification model using the training set, thereby classifying the observation window and predicting whether an alarm event will occur in the corresponding prediction window.
[0031] Thirdly, this application provides a power environment monitoring system, wherein the power environment monitoring system is equipped with the alarm event prediction model, and the alarm event prediction model is a model trained using any one of the alarm event prediction model training methods described above.
[0032] This application provides a method, apparatus, and power environment monitoring system for training an alarm event prediction model. When executing the method, the size of the observation window and the prediction window corresponding to the observation window after a first time interval are first determined. Based on whether an alarm event occurs in the prediction window, the observation windows corresponding to the prediction windows are labeled as positive and negative samples, thereby determining the range of the training data (observation window) and the prediction target (prediction window). Alarm data and monitoring data from multiple observation windows are extracted from the training data. Noise reduction processing is performed on the alarm data of multiple observation windows through multi-instance learning. The data volume of positive and negative observation windows is balanced by oversampling to form a training set. A classification model is trained using the training set to obtain a trained classification model, which is then used to classify observation windows and predict whether an alarm event will occur in the corresponding prediction window. Thus, by classifying observation windows using the classification model, it is possible to predict whether future prediction windows will experience alarm events. By predicting alarm events in advance, maintenance personnel can take proactive measures to prevent these events, thereby reducing economic losses and improving the stability of data center equipment operation and overall maintenance quality. Attached Figure Description
[0033] To more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings used in the description of the embodiment or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0034] Figure 1 A flowchart illustrating a method for training an alarm event prediction model provided in an embodiment of this application;
[0035] Figure 2 This is a schematic diagram of the structure of an alarm event prediction model training device provided in an embodiment of this application. Detailed Implementation
[0036] To provide a more detailed understanding of the features and technical content of the embodiments of this disclosure, the implementation of the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for illustrative purposes only and are not intended to limit the embodiments of this disclosure. In the following technical description, for ease of explanation, several details are used to provide a full understanding of the disclosed embodiments. However, one or more embodiments may still be implemented without these details. In other cases, well-known structures and devices may be simplified in their depiction to simplify the drawings.
[0037] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion.
[0038] Unless otherwise stated, the term "multiple" means two or more. In embodiments of this disclosure, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B means: A or B. The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B.
[0039] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0040] See Figure 1 , Figure 1 This is a flowchart illustrating an alarm event prediction model training method provided in an embodiment of this application. The alarm event prediction model training method includes:
[0041] S101. Determine the size of the observation window and the prediction window corresponding to the observation window after a first time interval. Based on whether an alarm event occurs in the prediction window, mark the observation window corresponding to the prediction window as positive and negative samples.
[0042] Optionally, the time window can be divided using a moving time window of size w and a fixed step size Δt. For example, for the current time t, an observation window [t - w, t] is selected, and then alarm data within the observation window is used to analyze whether an alarm event will occur within the prediction window [t + tl, t + tl + tp], where the first duration tl is greater than or equal to the shortest duration required to handle the alarm. After predicting the event, engineers have tl of advance time to handle the potential alarm event.
[0043] S102. Extract alarm data and monitoring data from multiple observation windows in the training data.
[0044] Optionally, textual features, statistical features, and monitoring data of alarm data from multiple observation windows in the training data can be extracted. The monitoring data includes normal monitoring metrics and alarm metrics. Based on operational experience, many specific combinations of normal monitoring metrics are strongly correlated with alarms.
[0045] Optionally, the training data mentioned above can be data monitored by the power and environment monitoring system. The main function of the power and environment monitoring system is to monitor data center infrastructure equipment (UPS, diesel generator, precision air conditioner, etc.) and environmental information (temperature, humidity, dust, hydrogen concentration, etc.).
[0046] S103. Noise reduction processing is performed on alarm data from multiple observation windows through multi-instance learning.
[0047] The training data for multi-instance learning consists of a bag of multiple instances. Each bag has a category label, but the instances within the bag are not labeled individually. This application adjusts the proportion of multiple instance windows (instances) in the observation window (bag) by setting weights, so as to reduce the weight of many instance windows with features that are not of great reference value in the observation window, thereby reducing noise alarms and more accurately representing the features of the observation window.
[0048] S104. The data volume of the observation windows of positive samples and negative samples is balanced by oversampling to form a training set.
[0049] Understandably, when the number of samples in one class is far less than that in other classes in a dataset, the model may be biased towards the majority class, leading to a decrease in prediction performance for the minority class. In this case, oversampling can be used to balance the dataset by increasing the number of minority class samples, thereby improving the model's ability to identify the minority class.
[0050] S105. The training model is used to train the classification model to obtain the trained classification model, and the trained classification model is used to classify the observation window and predict whether the corresponding prediction window will have an alarm event.
[0051] A classification model is a type of machine learning method used to predict discrete class labels. It learns the mapping relationship between input features and classes to classify new data into predefined categories. The module that executes the classification model is also called a classifier. In binary classification problems, the desired class is called a positive classification, and the opposite is a negative classification.
[0052] Optionally, in this application, the classification algorithm can be the XGBoost model. The classification model is constructed using the gradient boosting tree model XGBoost. The advantages of XGBoost include: high parallelism and high efficiency, making it suitable for ensemble learning algorithms. Furthermore, XGBoost is essentially a regression tree; tree-based models naturally possess feature selection capabilities, which are superior to algorithms such as neural networks and random forests.
[0053] As described in steps S101-S105 above, this application transforms the event prediction problem into a classification problem of observation windows. A classification model is used to classify and judge the observation windows, predicting whether alarm events will occur in future prediction windows. By predicting alarm events in advance, maintenance personnel can take proactive measures to prevent these events, thereby reducing economic losses and improving the stability of data center equipment operation and overall maintenance quality.
[0054] In the embodiments of this application, the above Figure 1 There are several possible implementations of step S102, which will be described below. It should be noted that the implementations given below are merely illustrative examples and do not represent all implementations of the embodiments of this application.
[0055] In one possible implementation, the extraction of alarm data text features from the multiple observation windows may include:
[0056] A K-dimensional text feature vector is generated for each observation window. Each element in the text feature vector represents the probability of the corresponding topic. The topic is characterized by the distribution of words in the alarm data text content of the observation window. The number of times the words appear in the text content reaches a preset condition.
[0057] Optionally, the above preset conditions are used to indicate that the word appears frequently in the text content. For example, the preset conditions may be that the word appears more than a preset number of times in the text content, or that the word is among the top K words when all words in the text content are sorted from most to least frequent.
[0058] Understandably, text content is the most informative attribute in alarm data, and rule-based event prediction methods also focus on alarm content. Therefore, the key to feature recognition is extracting text features from alarm content. This application combines the Term Frequency-Inverse Document Frequency (TF-IDF) method from Natural Language Processing. All alarm content within each time window (observation window) is considered as a document composed of various topics. Each topic is represented by the distribution of frequently occurring words in the document, and the probability distribution of the topic serves as the feature vector for that time window. Furthermore, a K-dimensional text feature vector is generated for each observation window, where each element represents the probability of a topic.
[0059] In one possible implementation, the extraction of alarm data statistical features from the multiple observation windows may include:
[0060] Extract the alarm count, window time, and arrival interval for each observation window.
[0061] The alarm count includes one or more of the following: the total number of alarms in the observation window, the number of alarms of different severity levels (e.g., low, medium, high), and the number of alarms of different types (e.g., precision air conditioner, UPS, battery, small busbar, etc.).
[0062] The window time refers to the time characteristic data of the observation window, such as the number of monitoring hours in a day, whether it is a weekend, what day of the week it is, whether it is business hours, etc.
[0063] The arrival interval is the average time interval between consecutive alarms within the observation window. The more frequently alarms occur, the more likely an alarm event is to occur.
[0064] In one possible implementation, step S103 above may include:
[0065] Identify the multiple instance windows included in each observation window, and extract features from each instance window;
[0066] Configuring weights for the multiple instance windows, wherein the more meaningless alarms are included in the extracted features of an instance window, the lower the configured weight;
[0067] Based on the weights configured for each instance window, the features extracted from the multiple instance windows are aggregated into the features of a single package, which is then used as the features of the observation window.
[0068] In this way, an observation window is divided into multiple smaller instance windows, and each observation window is treated as a package containing multiple instances. This allows for the exploration of finer-grained time windows. If an instance window contains many alarms that are not very meaningful, then a smaller weight can be assigned to that instance during the aggregation process, thereby reducing the impact of noisy alarms and improving the accuracy of subsequent classification model learning and prediction.
[0069] In one possible implementation, step S101 above, marking the observation window corresponding to the prediction window as positive and negative samples based on whether an alarm event occurs in the prediction window, includes: if an alarm event occurs in the prediction window, the observation window corresponding to the prediction window is marked as a positive sample; if no alarm event occurs in the prediction window, the observation window corresponding to the prediction window is marked as a negative sample.
[0070] Furthermore, in step S104 above, the data volume of the observation window for positive samples and the observation window for negative samples by oversampling includes: generating synthetic samples as positive samples using the K-nearest neighbor algorithm.
[0071] In a stable data center environment, the frequency of alarm events in the power environment monitoring system is very low, resulting in a significantly smaller number of positive sample observation windows compared to negative sample observation windows. To better handle imbalanced data, this application employs an oversampling strategy to balance positive and negative samples. Synthetic samples are generated using the K-nearest neighbor algorithm within the minority class (i.e., the observation window for positive samples), thereby oversampling the minority class. This avoids the problem of the model potentially biasing towards the majority class when the number of samples from one class in the dataset is significantly less than other classes, leading to a decrease in the predictive performance of the minority class and improving the accuracy of subsequent classification model predictions.
[0072] Based on the above embodiments, this application makes full use of various data from the environmental monitoring system. The training data not only includes alarm data but also incorporates daily monitoring indicators, enriching the features of the time window. Simultaneously, multi-instance learning is employed to denoise the alarm data, and oversampling is used to balance the number of positive and negative samples, improving the accuracy of the model in predicting alarm events.
[0073] The above describes some specific implementations of the alarm event prediction model training method provided in this application. Based on this, this application also provides a corresponding apparatus. The apparatus provided in this application will be described below from the perspective of functional modularity.
[0074] See Figure 2 The diagram shown illustrates the structure of an alarm event prediction model training device. The alarm event prediction model training device includes:
[0075] Setting unit 201 is used to determine the size of the observation window and the prediction window corresponding to the observation window after the first time interval, and to mark the observation window corresponding to the prediction window as positive and negative samples according to whether the prediction window has an alarm event.
[0076] Extraction unit 202 is used to extract alarm data and monitoring data from multiple observation windows in the training data;
[0077] The noise reduction unit 203 is used to perform noise reduction processing on alarm data from multiple observation windows through multi-instance learning;
[0078] The oversampling unit 204 is used to balance the amount of data in the observation windows of positive samples and negative samples through oversampling to form a training set;
[0079] The training unit 205 is used to train a classification model using the training set to classify the observation window and predict whether an alarm event will occur in the corresponding prediction window.
[0080] Using the aforementioned device, this application classifies and judges the observation window through a classification model to predict whether an alarm event will occur in the future prediction window. By predicting alarm events in advance, operation and maintenance personnel can take proactive measures to prevent these events, thereby reducing economic losses and improving the stability of data center equipment operation and overall operation and maintenance quality.
[0081] In one possible implementation, the first duration is greater than or equal to the shortest duration required to process the alarm.
[0082] In one possible implementation, the classification model is the XGBoost model.
[0083] In one possible implementation, the extraction unit 202 is specifically used to extract alarm data text features, alarm data statistical features, and monitoring data from multiple observation windows in the training data, wherein the monitoring data includes normal monitoring indicators and alarm indicators.
[0084] In one possible implementation, the extraction unit 202 is specifically used to generate a K-dimensional text feature vector for each observation window. Each element in the text feature vector represents the probability of the corresponding topic. The topic is characterized by the distribution of words in the alarm data text content of the observation window, and the number of times the words appear in the text content reaches a preset condition.
[0085] In one possible implementation, the extraction unit 202 is specifically used to extract the alarm count, window time, and arrival interval time of each observation window; wherein, the alarm count includes one or more of the total number of alarms in the observation window, the number of alarms of different severity levels, and the number of alarms of different types; the window time is the time characteristic data of the observation window; and the arrival interval time is the average time interval between consecutive alarms within the observation window.
[0086] In one possible implementation, the noise reduction unit 203 is specifically used to determine the multiple instance windows included in each observation window and extract features from each instance window; configure weights for the multiple instance windows, wherein the more meaningless alarms are included in the extracted features of an instance window, the lower the configured weight; and aggregate the features extracted from the multiple instance windows into the features of a package according to the weights configured for each instance window, as the features of the observation window.
[0087] In one possible implementation, the setting unit 201 is specifically used to mark the observation window corresponding to the prediction window as a positive sample when an alarm event occurs in the prediction window; and to mark the observation window corresponding to the prediction window as a negative sample when no alarm event occurs in the prediction window.
[0088] The oversampling unit 204 is specifically used to generate synthetic samples as positive samples using the K-nearest neighbor algorithm.
[0089] This application also provides a corresponding power environment monitoring system and computer storage medium for implementing the solution provided in this application.
[0090] The aforementioned power environment monitoring system is equipped with an alarm event prediction model, which is a model trained using an alarm event prediction model training method described in any of the above embodiments.
[0091] Optionally, it can be deployed in the basic infrastructure of data center computer rooms, providing support services specifically for basic infrastructure maintenance engineers.
[0092] The computer storage medium stores code. When the code is run, the device running the code implements an alarm event prediction model training method as described in any embodiment of this application.
[0093] In the embodiments of this application, the terms "first" and "second" (if they exist) are used only as name identifiers and do not represent the order of first and second.
[0094] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the methods of the above embodiments can be implemented by means of software plus a general-purpose hardware platform. Based on this understanding, the technical solution of this application can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as a read-only memory (ROM) / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, a server, or a network communication device such as a router) to execute the methods described in various embodiments or some parts of the embodiments of this application.
[0095] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.
[0096] The above description is merely an exemplary implementation of this application and is not intended to limit the scope of protection of this application.
Claims
1. A method for training an alarm event prediction model, characterized in that, The method includes: Determine the size of the observation window and the prediction window corresponding to the observation window after a first time interval. Based on whether an alarm event occurs in the prediction window, mark the observation window corresponding to the prediction window as positive and negative samples. Extract alarm data and monitoring data from multiple observation windows in the training data; Noise reduction is performed on alarm data from multiple observation windows through multi-instance learning; The training set is formed by balancing the data volume of the observation windows for positive samples and negative samples through oversampling; The training set is used to train the classification model to obtain the trained classification model, which is then used to classify the observation window and predict whether an alarm event will occur in the corresponding prediction window.
2. The method according to claim 1, characterized in that, The first duration is greater than or equal to the minimum duration required to process the alarm.
3. The method according to claim 1, characterized in that, The extraction of alarm data and monitoring data from multiple observation windows in the training data includes: Extract alarm data text features, alarm data statistical features, and monitoring data from multiple observation windows in the training data. The monitoring data includes normal monitoring indicators and alarm indicators.
4. The method according to claim 3, characterized in that, Extract the text features of the alarm data from the multiple observation windows, including: A K-dimensional text feature vector is generated for each observation window. Each element in the text feature vector represents the probability of the corresponding topic. The topic is characterized by the distribution of words in the alarm data text content of the observation window. The number of times the words appear in the text content reaches a preset condition.
5. The method according to claim 3, characterized in that, Extract statistical features of the alarm data from the multiple observation windows, including: Extract the alarm count, window time, and arrival interval for each observation window; wherein, the alarm count includes one or more of the total number of alarms in the observation window, the number of alarms of different severity levels, and the number of alarms of different types; the window time is the time characteristic data of the observation window; and the arrival interval is the average time interval between consecutive alarms within the observation window.
6. The method according to claim 1, characterized in that, The noise reduction process for alarm data from multiple observation windows through multi-instance learning includes: Identify the multiple instance windows included in each observation window, and extract features from each instance window; Configuring weights for the multiple instance windows, wherein the more meaningless alarms are included in the extracted features of an instance window, the lower the configured weight; Based on the weights configured for each instance window, the features extracted from the multiple instance windows are aggregated into the features of a single package, which is then used as the features of the observation window.
7. The method according to claim 1, characterized in that, The step of labeling the observation window corresponding to the prediction window with positive and negative samples based on whether an alarm event occurs in the prediction window includes: If an alarm event occurs in the prediction window, the observation window corresponding to the prediction window is marked as a positive sample; if no alarm event occurs in the prediction window, the observation window corresponding to the prediction window is marked as a negative sample. The amount of data used to balance the observation windows of positive and negative samples through oversampling includes: Synthetic samples are generated using the K-nearest neighbor algorithm and used as positive samples.
8. The method according to claim 1, characterized in that, The classification model is the XGBoost model.
9. A training device for an alarm event prediction model, characterized in that, The device includes: The setting unit is used to determine the size of the observation window and the prediction window corresponding to the observation window after a first time interval, and to mark the observation window corresponding to the prediction window as positive and negative samples according to whether an alarm event occurs in the prediction window. The extraction unit is used to extract alarm data and monitoring data from multiple observation windows in the training data; The noise reduction unit is used to perform noise reduction processing on alarm data from multiple observation windows through multi-instance learning; The oversampling unit is used to balance the amount of data in the observation windows of positive samples and negative samples through oversampling, thus forming a training set; The training unit is used to train a classification model using the training set, thereby classifying the observation window and predicting whether an alarm event will occur in the corresponding prediction window.
10. A power environment monitoring system, characterized in that, The power environment monitoring system is equipped with the alarm event prediction model, which is a model trained using the alarm event prediction model training method described in any one of claims 1-8.