Alarm method, device, equipment, storage medium and product

Abstract

The embodiment of the invention provides an alarm method and device, equipment, a storage medium and a product, and relates to the technical field of artificial intelligence. The method comprises the steps of obtaining initial operation data of equipment; determining an initial data index corresponding to the initial operation data, and determining a plurality of associated data indexes corresponding to the initial data index through the association matrix; performing data acquisition on the operation data of the equipment according to the initial data index and the plurality of associated data indexes to obtain a plurality of acquisition data; and inputting the initial data index, the plurality of associated data indexes and the plurality of acquired data into an abnormal data prediction model to obtain an abnormal data index, target abnormal data and a predicted abnormal moment, and performing alarm processing. According to the scheme, the alarm is given based on the initial operation data and the associated data through the abnormal data prediction model, the initial operation data and the associated data can be mutually verified, and compared with a manual mode for judging isolated data, the alarm accuracy can be effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and particularly relates to an alarm method and device, equipment, a storage medium and a product. BACKGROUND

[0002] In the running process of the device, the device generates data in real time, and the data can reflect the running state of the device. For example, the data can be interface response time or memory usage, etc. When the data exceeds the preset range, it indicates that the device may have an abnormality, and corresponding measures need to be taken for the device.

[0003] In the bank application scenario, the number of device access is large, and the access pressure of the device is large, and the stable running of the device has high requirements. Therefore, accurate alarm needs to be performed on the device to perform targeted optimization on the device.

[0004] In the related art, the data of the device is judged by manual means to perform alarm, and there is a problem of low accuracy. SUMMARY

[0005] The present application provides an alarm method, device, equipment, storage medium and product to improve the accuracy of the alarm.

[0006] In a first aspect, the present application provides an alarm method, comprising: obtaining initial running data of a device, the initial running data being located in a first data range; determining an initial data index corresponding to the initial running data, determining a plurality of associated data indexes corresponding to the initial data index through an association matrix; collecting running data of the device according to the initial data index and the plurality of associated data indexes to obtain a plurality of collected data; inputting the initial data index, the plurality of associated data indexes, and the plurality of collected data into an abnormal data prediction model to obtain an abnormal data index, a target abnormal data, and a predicted abnormal time; and performing alarm processing according to the abnormal data index, the target abnormal data, and the predicted abnormal time.

[0007] In a second aspect, the present application provides an alarm device, comprising: an acquisition module configured to acquire initial operation data of a device, the initial operation data being located in a first data range; a determination module configured to determine an initial data index corresponding to the initial operation data, and determine a plurality of associated data indexes corresponding to the initial data index through an association matrix; an acquisition module configured to acquire operation data of the device according to the initial data index and the plurality of associated data indexes, and obtain a plurality of acquisition data; a prediction module configured to input the initial data index, the plurality of associated data indexes, and the plurality of acquisition data into an abnormal data prediction model, and obtain an abnormal data index, a target abnormal data, and a predicted abnormal time; and an alarm module configured to perform alarm processing according to the abnormal data index, the target abnormal data, and the predicted abnormal time.

[0008] In a third aspect, an embodiment of the present application provides an alarm device, comprising: a memory, and a processor;

[0009] The memory stores computer execution instructions.

[0010] The processor executes the computer execution instructions stored in the memory, so that the processor executes the first aspect and / or various possible implementation manners of the first aspect.

[0011] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the first aspect and / or various possible implementation manners of the first aspect.

[0012] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the first aspect and / or various possible implementation manners of the first aspect.

[0013] The alarm method, device, equipment, storage medium and product provided by the application, the method comprises: obtaining initial operation data of a device, the initial operation data being located in a first data range; determining an initial data index corresponding to the initial operation data, determining a plurality of associated data indexes corresponding to the initial data index through an association matrix; collecting operation data of the device according to the initial data index and the plurality of associated data indexes to obtain a plurality of collected data; inputting the initial data index, the plurality of associated data indexes and the plurality of collected data into an abnormal data prediction model to obtain an abnormal data index, target abnormal data and a predicted abnormal moment; and performing alarm processing according to the abnormal data index, the target abnormal data and the predicted abnormal moment. The above scheme performs alarm based on initial operation data and associated data through an abnormal data prediction model. The initial operation data and the associated data can be verified with each other, and compared with a manual method for judging isolated data, the accuracy of alarm can be effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0014] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0015] Figure 1 An application scenario diagram of an alarm method provided by an embodiment of the application;

[0016] Figure 2 A flowchart of an alarm method provided by an embodiment of the application;

[0017] Figure 3 A flowchart of an alarm method provided by an embodiment of the application;

[0018] Figure 4 A diagram for determining associated data indexes provided by an embodiment of the application;

[0019] Figure 5 A diagram for collecting data at a timing provided by an embodiment of the application;

[0020] Figure 6 A diagram for alarm processing provided by an embodiment of the application;

[0021] Figure 7 A structural diagram of an alarm device provided by an embodiment of the application;

[0022] Figure 8 A structural diagram of an alarm device provided by an embodiment of the application;

[0023] Figure 9 A structural diagram of an electronic device provided by an embodiment of the application.

[0024] The specific embodiments of the application will be described in detail below with reference to the drawings. These drawings and the associated description are not intended to limit the scope of the application in any way, but merely to illustrate the concept of the application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0025] The exemplary embodiments will be described in detail below with reference to the drawings. The following description is not intended to limit the scope of the application in any way, but merely to illustrate the concept of the application to those skilled in the art by reference to specific embodiments.

[0026] In the embodiments of the present application, "at least one" means one or more, and "multiple" means two or more. The "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the following three cases: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single item or multiple items. For example, at least one of a, b, or c can represent a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.

[0027] It should be noted that "at the time of" in the embodiments of the present application can be at the moment when a certain condition occurs, or within a certain period of time after the occurrence of a certain condition, which is not limited in the embodiments of the present application. In addition, the display interface provided by the embodiments of the present application is only an example, and the display interface can also include more or less content.

[0028] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards of relevant countries and regions, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal.

[0029] And the present application relates to the big data analysis of user information (including but not limited to personal biological characteristics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and the automatic decision is made by using artificial intelligence technology, the technical scheme is made based on the automatic decision result, the operation entrance is provided for the user, the user selects to agree or refuse the automatic decision result, if the user selects to refuse, then enter the expert decision process.

[0030] It should be noted that the alarm method, device, equipment, storage medium and product provided by the present application can be used in the field of artificial intelligence technology, and can also be used in any field other than artificial intelligence. The application field of the alarm method, device, equipment, storage medium and product in the present application is not limited.

[0031] Figure 1 The application scenario of the alarm method provided by the embodiments of the present application is shown in the figure, and examples are given in combination with the illustrated scenario: the device generates data reflecting the running state of the device during operation, analyzes the data to determine the abnormality of the device, and performs alarm processing according to the abnormality to optimize the device for the staff.

[0032] In actual application, different abnormal data are respectively generated by corresponding types of faults, and the fault type can be accurately determined according to the abnormal data, so that accurate alarm processing can be performed.

[0033] In related technologies, whether the data exceeds the preset range is determined by manual method, if it exceeds, alarm processing is performed, if it does not exceed, no alarm processing is performed. However, there is a correlation between multiple data, and the correlation between the multiple data cannot be explained by only determining the preset range. For example, when the memory usage rate rises, the interface response delay may increase next time, and the manual method cannot accurately identify the interface response delay, but only identifies the fault of high memory usage rate. There is a fixed time difference between the moment when the disk IO throughput increases and the moment when the database query success rate decreases, and the manual method cannot accurately identify the fault of the database query success rate decrease, but simply locates the fault as a disk fault. Inaccurate identification of the fault means that the corresponding optimization cannot be accurately performed.

[0034] The alarm method, device, equipment, storage medium and product provided by the present application aim to solve the above technical problems of the prior art.

[0035] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0036] Figure 2 A flowchart of an alarm method provided by an embodiment of the present application is shown in the figure. The method comprises the following steps:

[0037] S201, initial running data of a device is acquired, and the initial running data is located in a first data range.

[0038] For example, the first data range is a range of data fluctuation, and the initial running data located in the first preset range indicates that the initial running data has an abnormal trend, and further judgment needs to be performed, and an alarm is performed according to a result of the further judgment.

[0039] For example, the data index corresponding to the initial running data is the memory usage rate. When the memory usage rate is less than 70%, it is determined that the device is normal, and the first data range is 70%-80%. When the memory usage rate is located in the range of 70%-80%, it is determined that the memory usage rate has an abnormal trend. At this time, further judgment is performed to determine the cause of the abnormal trend to perform alarm processing.

[0040] In the related art, when the initial running data reaches a threshold value, an alarm is directly performed. For example, when the memory usage rate is greater than 80%, an alarm is directly performed. However, the large memory usage rate can be caused by various reasons. If the data is not analyzed, the problem of low alarm accuracy can be caused.

[0041] S202, an initial data index corresponding to the initial running data is determined, and a plurality of associated data indexes corresponding to the initial data index are determined through an association matrix.

[0042] For example, the associated data indexes are associated with the initial data index, that is, when the data of the initial data index changes, the data of the associated data indexes changes accordingly.

[0043] Optionally, the association matrix is established according to the association relationship between the plurality of data indexes. Through the association matrix, the associated data indexes associated with the initial data index can be accurately determined.

[0044] Optionally, the initial data index and the associated data index can each include a business index or a bottom layer index. The business index is, for example, an interface response time. The bottom layer index is, for example, a processor usage rate, a memory usage rate, or a disk IO throughput.

[0045] S203, running data of the device is collected according to the initial data index and the plurality of associated data indexes, and a plurality of collected data is obtained.

[0046] Exemplarily, the data collection process is performed after the initial operation data is determined, and after the initial operation data is determined, corresponding data is collected according to the initial data index and the plurality of associated data indexes to obtain a plurality of collected data. Any one of the collected data corresponds to one of the initial data index and the plurality of associated data indexes.

[0047] In combination with a scene example, taking the initial data index as the memory usage rate and the associated data index as the database query time consumption as an example, the collected data includes a plurality of memory usage rate data and a plurality of database query time consumption data, and the trend of the plurality of collected data can further determine whether a fault will occur.

[0048] S204, input the initial data index, the plurality of associated data indexes, and the plurality of collected data into the abnormal data prediction model to obtain an abnormal data index, a target abnormal data, and a predicted abnormal time.

[0049] Exemplarily, the target abnormal data is an abnormal value that the abnormal data prediction model predicts that the operation data of the device will reach. The abnormal data index is a data index corresponding to the target abnormal data. The predicted abnormal time is a time predicted by the abnormal data prediction model to reach the target abnormal data.

[0050] In combination with a scene example, the abnormal data prediction model determines the change rule of the device operation data according to the initial data index, the plurality of associated data indexes, and the plurality of collected data, and predicts when the device operation data will reach what abnormal value in the future according to the change rule.

[0051] Optionally, the abnormal data prediction model is obtained by training a plurality of historical data, and the abnormal data prediction model learns the abstract mapping relationship between the collected data and the abnormal data in the plurality of historical data to make a prediction.

[0052] Based on the above embodiments, the initial data index and the associated data index are jointly used as inputs of the abnormal data prediction model, which can make the abnormal data prediction model combine the associated multi-dimensional data for prediction, thereby improving the accuracy of the prediction.

[0053] S205, according to the abnormal data index, the target abnormal data, and the predicted abnormal time, an alarm processing is performed.

[0054] Exemplarily, a plurality of information is used for alarm processing, so that the staff can determine an abnormal response scheme in all directions according to the plurality of information, thereby improving the accuracy of the alarm.

[0055] With the scene example, for example, the current time is 9 o'clock, and the predicted abnormal time is 11 o'clock, the alarm processing can make the staff have time to deal with the abnormality. The staff can accurately locate the position of the abnormality according to the abnormal data index, so as to accurately process. The target abnormal data can directly reflect the degree of abnormality, so that the staff can take targeted processing according to the degree of abnormality.

[0056] The alarm method provided by the embodiment of the application comprises the following steps: obtaining initial operation data of a device, wherein the initial operation data is located in a first data range; determining an initial data index corresponding to the initial operation data, and determining a plurality of associated data indexes corresponding to the initial data index through an association matrix; collecting operation data of the device according to the initial data index and the plurality of associated data indexes to obtain a plurality of collected data; inputting the initial data index, the plurality of associated data indexes and the plurality of collected data into an abnormal data prediction model to obtain an abnormal data index, target abnormal data and a predicted abnormal time; and performing alarm processing according to the abnormal data index, the target abnormal data and the predicted abnormal time. The above scheme can perform alarm based on the initial operation data and the associated data through the abnormal data prediction model. The initial operation data and the associated data can be verified with each other, and compared with the manual mode for judging the isolated data, the accuracy of the alarm can be effectively improved.

[0057] On the basis of any one of the above embodiments, the following will be described in combination with Figure 3 , the detailed process of the alarm is described.

[0058] Figure 3 A flowchart of an alarm method provided by the embodiment of the application is shown in FIG. 1. As shown in the figure, the method comprises the following steps. Figure 3

[0059] S301, obtaining initial operation data of a device, wherein the initial operation data is located in a first data range.

[0060] It should be noted that the execution process of S301 is described in S201, which will not be repeated here.

[0061] S302, determining a data index library, and determining a plurality of candidate data indexes from the data index library.

[0062] For example, the plurality of candidate data indexes represent the running state of the device from different dimensions. The plurality of candidate data indexes include data indexes associated with the initial data index.

[0063] Optionally, the data index library is updated according to the operation data of the device. When the device generates a new operation data type, the data index library synchronously increases the data index corresponding to the new operation data type.

[0064] ​S303, input the initial data indicator and the plurality of candidate data indicators into a correlation coefficient matrix to obtain a plurality of initial correlation indicators and a plurality of correlation coefficients corresponding to the plurality of initial correlation indicators.

[0065] The association matrix includes the correlation coefficient matrix and a convergence coefficient matrix.

[0066] For example, when the memory usage is too high, the interface response time will also increase accordingly, and there is an association between the memory usage and the interface response time. The correlation coefficient matrix can quantify the correlation between the memory usage and the interface response time.

[0067] For example, each initial correlation indicator is related to the initial data indicator, and the correlation coefficient is used to quantify the correlation degree between the initial correlation indicator and the initial data indicator.

[0068] Optionally, each data indicator in the initial data indicator library is arranged in descending order according to the correlation coefficient between the initial data indicator, and a preset number of data indicators arranged in the front are determined as the plurality of initial correlation indicators.

[0069] S304, input the initial data indicator and the plurality of candidate data indicators into a convergence coefficient matrix to obtain a plurality of initial convergence indicators and a plurality of convergence coefficients corresponding to the plurality of initial convergence indicators.

[0070] For example, the convergence coefficient matrix is used to quantify the lagging convergence between a plurality of data indicators, and the lagging convergence will not be immediately reflected. For example, after the network packet loss rate increases, the user interface lag increases after 15s. The convergence coefficient matrix can quantify the convergence between the network packet loss rate and the user interface lag rate.

[0071] For example, each initial convergence indicator has convergence with the initial data indicator, and the convergence coefficient is used to quantify the convergence degree between the initial convergence indicator and the initial data indicator.

[0072] In the related art, only the initial data indicator and the threshold value are used to determine the abnormal type, which has errors and can cause low alarm accuracy.

[0073] In the present application, the data of the initial data indicator and the data of the convergence indicator are combined to locate the specific abnormal type of the device, thereby improving the accuracy of the alarm.

[0074] It should be noted that the execution order of S303 and S304 is not limited in the present application.

[0075] S305, according to the plurality of initial correlation indicators, the plurality of correlation coefficients, the plurality of initial convergence indicators, and the plurality of convergence coefficients, a plurality of association data indicators are determined.

[0076] One feasible implementation method involves determining multiple correlation indicators as follows: identifying multiple initial correlation indicators and multiple initial convergence indicators that overlap; determining the first weight corresponding to the correlation coefficient and the second weight corresponding to the convergence coefficient; for any overlapping indicator, performing weighted calculation on the correlation coefficient and convergence coefficient of the overlapping indicator according to the first weight and the second weight to obtain the weight corresponding to the overlapping indicator; sorting the multiple overlapping indicators according to the weights corresponding to the multiple overlapping indicators to obtain an indicator sequence; and determining multiple related data indicators from the indicator sequence.

[0077] For example, an overlap indicator is a data indicator that is both a convergent indicator and an overlap indicator, meaning that there is both correlation and convergence between the overlap indicator and the initial data indicator.

[0078] To illustrate with scenario examples, determining data metrics solely based on correlation or solely based on convergence can lead to coincidences. That is, the data of the related data metrics may change synchronously or asynchronously with the data of the initial data metrics due to coincidence, rather than due to a device anomaly. Therefore, alarms based on this result in low accuracy.

[0079] In this application, the overlap index can combine correlation and convergence to reduce the error caused by using only one of correlation or convergence.

[0080] Below, in conjunction with Figure 4 Explanation of the determination of related data indicators.

[0081] Figure 4 This is a schematic diagram illustrating the determination of associated data indicators provided in an embodiment of this application. For example... Figure 4 As shown, overlapping data indicators among multiple initial correlation indicators and multiple initial convergence indicators are identified as multiple overlapping indicators. The correlation coefficient and convergence coefficient of each overlapping indicator are weighted according to a first weight and a second weight. The multiple overlapping indicators are then sorted according to the calculated weights to obtain an indicator sequence, from which multiple related data indicators are determined.

[0082] Optionally, the weights represent the degree of correlation between the overlapping indicators and the initial data indicators. A predetermined number of overlapping indicators ranked first in the indicator sequence are identified as multiple related data indicators. It can be understood that the multiple related data indicators determined according to the ranking of the indicator sequence have the highest correlation with the initial data indicators.

[0083] In this feasible implementation, the correlation of the associated data indicators determined by combining the correlation coefficient and the convergence coefficient can be improved with the initial data indicators. On this basis, the correlation between the determined collected data can be improved, thereby improving the accuracy of the alarm.

[0084] S306, collecting operation data of the device according to the initial data index and the plurality of associated data indexes to obtain a plurality of collected data.

[0085] In an example, the plurality of collected data can be obtained by determining a collection time period, generating a timing task according to the collection time period, and collecting data according to the initial data index and the plurality of associated data indexes by using the timing task.

[0086] For example, the collection time period is a future time period, and the plurality of collected data is obtained by continuously collecting data in the collection time period.

[0087] Optionally, the timing task can be determined according to a fixed collection interval. For example, if the collection interval is 10 minutes, the timing task is to trigger collection every 10 minutes in the collection time period.

[0088] Optionally, the timing task can be determined according to a flexible collection interval. For example, as the collection time is farther and farther away from the current time, the collection interval gradually increases.

[0089] Optionally, the timing task can be determined according to a plurality of specified collection times, and there is no regularity between the plurality of specified collection times.

[0090] For example, the current time is 9 o'clock, the collection time period is 9 o'clock-10 o'clock, and the timing task is set in the collection time period to trigger a plurality of data collections. Each data collection is performed according to the initial data index and the plurality of associated data indexes, so as to avoid unnecessary data collection and increase overhead.

[0091] In this example, the timing task is used to collect data to obtain dynamically changing collected data, so that the abnormal data prediction model can accurately predict the related information of the abnormal data according to the dynamic change rule of the collected data.

[0092] In an example, the plurality of collected data can be obtained by determining a collection time period and a time series database, the time series database including a plurality of time series data, and data indexes and collection times corresponding to the plurality of time series data, respectively; and determining the plurality of collected data from the time series database according to the collection time period, the initial data index, and the plurality of associated data indexes, wherein each collected data corresponds to the initial data index or any one of the plurality of associated data indexes, and the collection time of each collected data is within the collection time period.

[0093] The time sequence data is generated in real time according to the running state of the device during the running of the device, and the time sequence data includes a time point of generating the time sequence data. The time sequence data is stored in the time sequence database in real time after each time sequence data is generated. The time sequence database can be queried and read as needed, and is not limited to being used for alarm. The time sequence data is stored for backtracking of the running state of the device.

[0094] The collection time period, the initial data index, and the plurality of associated data indexes are used to locate the position of the collection data in the time sequence database. The corresponding collection data is read from the time sequence database according to the position of the collection data.

[0095] Optionally, the time sequence data is obtained from the log of the device. The log of the device records the running data of the device in real time.

[0096] The following describes the collection of time sequence data in combination with Figure 5 The collection of time sequence data is described.

[0097] Figure 5 The schematic diagram of the collection of time sequence data provided by the embodiment of the application is shown in FIG. 1. As shown in FIG. 1, the collection time period is determined according to the current time point of obtaining the initial running data. The time sequence data is collected according to the collection time period. Figure 5

[0098] Optionally, the time sequence database is accessed through a data access channel such as kafka and / or api.

[0099] In this feasible implementation manner, the collection operation can be reduced by obtaining the collection data from the time sequence database, so as to improve the efficiency of the alarm.

[0100] S307, input the initial data index, the plurality of associated data indexes, and the plurality of collection data into an abnormal data prediction model, to obtain an abnormal data index, target abnormal data, and a predicted abnormal time point.

[0101] It should be noted that the execution process of S307 is described in S204, which will not be described here.

[0102] S308, determine a multi-level alarm mapping table corresponding to the abnormal data index. The multi-level alarm mapping table includes a plurality of second data ranges and a plurality of alarm levels.

[0103] Optionally, the multi-level alarm mapping table groups the overall data range to obtain a plurality of second data ranges, and each second data range corresponds to a type of risk. The alarm level is used to distinguish the severity of different risks.

[0104] ​Optionally, the alarm level corresponds to the processing priority of the risk, the alarm level corresponding to a high risk is higher, and the corresponding processing priority is also higher, which should be processed in priority to reduce the impact on the equipment.

[0105] S309, determining a target data range corresponding to the target abnormal data in the plurality of second data ranges in the multi-level alarm mapping table.

[0106] For example, the plurality of second data ranges are divided independently without data range intersection, and the boundaries of the plurality of second data ranges can be adjacent.

[0107] For example, the target data range is a data range to which the target abnormal data belongs in the plurality of second data ranges.

[0108] S310, determining the alarm level corresponding to the target data range in the multi-level alarm mapping table as a target alarm level.

[0109] For example, the correspondence between the target data range and the target alarm level is predefined when the multi-level alarm mapping table is initialized.

[0110] Optionally, during the use of the multi-level alarm mapping table, the application scene can be adjusted according to the actual application scene to adapt to the application scene.

[0111] For example, the alarm level corresponding to the target data range is extracted from the multi-level alarm mapping table to obtain the target alarm level.

[0112] S311, generating alarm information according to the target abnormal data, the predicted abnormal moment, and the target alarm level, and performing alarm processing according to the alarm information.

[0113] Next, the alarm processing will be described in combination with Figure 6 The alarm processing is described.

[0114] Figure 6 The alarm processing provided by the embodiments of the present application is shown in the figure. As shown in Figure 6As shown, 100 monitors the collection and data service scheme, builds a multi-level index collection system (application layer / resource layer / network layer), including application product running index response time, call volume, success rate, resource index CPU, MEM, IO, DISK, SWAP, TCP and specific index of middleware, database, such as pool resource, load index, etc., delay, packet loss rate, bandwidth utilization, etc. of network layer. Data is persisted to time series database for storage, providing kafka and api data access channels. 200 monitors the data pipeline and data preprocessing scheme, realizes multi-source heterogeneous index synchronous collection and preprocessing. Through the api access index time series database by timing task, the required data is obtained. According to the actual need and the size of data volume, the parameters can be set. 201 correlation matrix and convergence coefficient scheme, establish dynamic correlation coefficient matrix and convergence coefficient model to reveal the implicit correlation between indexes. The correlation coefficient table is obtained by setting parallel computing for business running index and resource index, and the multiple indexes with the highest correlation are sorted and output as the main indexes for subsequent prediction, reducing the computing power consumption. 202 rolling period prediction scheme, based on the active early warning mechanism of trend prediction, the rolling window model is predicted. Read the index threshold parameter, and send an early warning when the threshold is reached. 300 correlation warning and sending scheme, according to the preset threshold parameter and strategy, combined with the index visualization pushed by 202, three-level warning decision is made, and the risk meeting the alarm sending is alarmed. 400 index threshold correction scheme, by accumulating the number of prediction alarms and triggering alarm statistics, for the indexes not included in the alarm threshold judgment process, new alarm threshold strategy is added, and the diversity and accuracy of alarm threshold strategy are enriched.

[0115] A feasible implementation manner can generate alarm information by the following method, comprising: determining a strategy mapping table corresponding to the abnormal data index, the strategy mapping table comprising a plurality of abnormal data, a plurality of alarm levels, and a plurality of optimization strategies; from the strategy mapping table, determining a target abnormal data and a target alarm level corresponding to a target optimization strategy; generating alarm information according to the target abnormal data, the predicted abnormal time, the target alarm level, and the target optimization strategy.

[0116] For example, the optimization strategy includes a fault handling method, and the worker can eliminate the influence of the fault on the equipment by referring to the optimization strategy for processing.

[0117] For example, the strategy mapping table is pre-configured, and the strategy mapping table is pre-configured according to the correspondence between the abnormal data and the alarm level and the optimization strategy. In actual use, the target optimization strategy can be accurately determined through the strategy mapping table.

[0118] According to the target optimization strategy, the work staff can receive the alarm information and the optimization strategy at the same time, and the work staff can determine the optimization strategy without going to the scene, so that the work staff can accurately determine how to deal with the exception.

[0119] In the feasible implementation manner, the target optimization strategy is automatically determined through the strategy mapping table, so that the operation of the user can be reduced, and the accuracy of the alarm can be improved.

[0120] Figure 7 A structural schematic diagram of an alarm device is provided in the embodiments of the present application. As shown in the figure, the alarm device 70 can include an acquisition module 71, a determination module 72, a collection module 73, a prediction module 74, and an alarm module 75, wherein, Figure 7 The acquisition module 71 is configured to acquire initial running data of the device, and the initial running data is located in a first data range.

[0121] The determination module 72 is configured to determine an initial data index corresponding to the initial running data, and determine a plurality of associated data indexes corresponding to the initial data index through an association matrix.

[0122] The collection module 73 is configured to collect running data of the device according to the initial data index and the plurality of associated data indexes, and obtain a plurality of collected data.

[0123] The prediction module 74 is configured to input the initial data index, the plurality of associated data indexes, and the plurality of collected data into an abnormal data prediction model, and obtain an abnormal data index, a target abnormal data, and a predicted abnormal time.

[0124] The alarm module 75 is configured to perform alarm processing according to the abnormal data index, the target abnormal data, and the predicted abnormal time.

[0125] Optionally, the acquisition module 71 can perform S201 in the embodiments.

[0126] Figure 2 Optionally, the determination module 72 can perform S202 in the embodiments.

[0127] Optionally, the collection module 73 can perform S203 in the embodiments. Figure 2 Optionally, the prediction module 74 can perform S204 in the embodiments.

[0128] Figure 2 Optionally, the alarm module 75 can perform S205 in the embodiments.

[0129] Figure 2

[0130] Figure 2 ​​​​​​

[0131] It should be noted that the alarm device shown in the embodiments of the present application can perform the technical solutions shown in the method embodiments, and the implementation principles and beneficial effects are similar, which will not be described here.

[0132] In a possible implementation, the correlation matrix includes a correlation coefficient matrix and a convergence coefficient matrix; the determining module 72 is specifically configured to:

[0133] determine a data index library, and determine a plurality of candidate data indexes from the data index library;

[0134] input the initial data index and the plurality of candidate data indexes into the correlation coefficient matrix to obtain a plurality of initial correlation indexes and a plurality of correlation coefficients corresponding to the plurality of initial correlation indexes;

[0135] input the initial data index and the plurality of candidate data indexes into the convergence coefficient matrix to obtain a plurality of initial convergence indexes and a plurality of convergence coefficients corresponding to the plurality of initial convergence indexes;

[0136] determine a plurality of associated data indexes according to the plurality of initial correlation indexes, the plurality of correlation coefficients, the plurality of initial convergence indexes, and the plurality of convergence coefficients.

[0137] In a possible implementation, the correlation matrix includes a correlation coefficient matrix and a convergence coefficient matrix; the determining module 72 is specifically configured to:

[0138] determine a plurality of overlapping indexes that overlap in the plurality of initial correlation indexes and the plurality of initial convergence indexes;

[0139] determine a first weight corresponding to the correlation coefficient and a second weight corresponding to the convergence coefficient;

[0140] for any one overlapping index, perform weighted calculation and processing on the correlation coefficient and the convergence coefficient of the overlapping index according to the first weight and the second weight to obtain a weight value corresponding to the overlapping index;

[0141] perform sorting processing on the plurality of overlapping indexes according to the weight values corresponding to the plurality of overlapping indexes respectively to obtain an index sequence;

[0142] determine a plurality of associated data indexes from the index sequence.

[0143] In a possible implementation, the alarm module 75 is specifically configured to:

[0144] determine a multi-level alarm mapping table corresponding to the abnormal data index, the multi-level alarm mapping table including a plurality of second data ranges and a plurality of alarm levels;

[0145] determine a target data range corresponding to a target abnormal data in the plurality of second data ranges in the multi-level alarm mapping table;

[0146] The alarm level corresponding to the target data range in the multi-level alarm mapping table is determined as the target alarm level;

[0147] Alarm information is generated based on the target abnormal data, the predicted time of abnormality, and the target alarm level, and alarm processing is performed based on the alarm information.

[0148] In one possible implementation, the alarm module 75 is specifically used for:

[0149] Determine the policy mapping table corresponding to the abnormal data indicators. The policy mapping table includes multiple abnormal data, multiple alarm levels, and multiple optimization policies.

[0150] From the strategy mapping table, determine the target optimization strategy corresponding to the target abnormal data and the target alarm level;

[0151] Alarm information is generated based on the target anomaly data, the predicted time of anomaly, the target alarm level, and the target optimization strategy.

[0152] Figure 8 This is a schematic diagram of an alarm device provided in an embodiment of this application. Figure 7 Based on the illustrated embodiments, as Figure 8 As shown, the alarm device 80 further includes: a first execution module 76 and a second execution module 77, wherein,

[0153] The first execution module 76 is used for:

[0154] Determine the data collection period;

[0155] Generate scheduled tasks based on the data collection period;

[0156] Based on the initial data indicators and multiple related data indicators, a scheduled task is used to collect data on a timed basis, resulting in multiple data collections.

[0157] The second execution module 77 is used for:

[0158] Determine the data collection period and time series database. The time series database includes multiple time series data points, as well as the data indicators and collection times corresponding to each time series data point.

[0159] Based on the collection period, initial data indicators, and multiple related data indicators, multiple collection data are determined from the time series database. The data indicator corresponding to each collection data is either the initial data indicator or any related data indicator, and the collection time corresponding to each collection data is within the collection period.

[0160] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 9As shown, the electronic device includes:

[0161] The electronic device further includes a processor 291 and a memory 292. The electronic device can further include a communication interface 293 and a bus 294. The processor 291, the memory 292, and the communication interface 293 can communicate with each other through the bus 294. The communication interface 293 can be used for information transmission. The processor 291 can invoke the logical instructions in the memory 292 to execute the method of the above-described embodiments.

[0162] In addition, the logical instructions in the memory 292 described above can be implemented in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer readable storage medium.

[0163] The memory 292, as a computer readable storage medium, can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiments of the present application. The processor 291 executes the functions and data processing by running the software programs, instructions, and modules stored in the memory 292, that is, implements the method in the above-described method embodiments.

[0164] The memory 292 can include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required by a function. The data storage area can store data created during use of the terminal device, and the like. In addition, the memory 292 can include a high-speed random access memory, and can further include a nonvolatile memory.

[0165] The embodiments of the present application provide a non-transitory computer readable storage medium, and the computer readable storage medium stores computer execution instructions. When the computer execution instructions are executed by a processor, the computer execution instructions are used to implement the method of the above-described embodiments.

[0166] The embodiments of the present application provide a computer program product, which includes a computer program. When the computer program is executed by a processor, the computer program implements the method of the above-described embodiments.

[0167] It should be noted that, for the above-described method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the present application is not limited to the order of the actions described, because according to the present application, certain steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0168] It should be understood that the device embodiments described above are merely illustrative, and the device of the present application can also be implemented in other manners. For example, the division of the units / modules in the above embodiments is merely a logical function division, and the actual implementation can be in another manner. For example, a plurality of units / modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0169] It should be understood that the device embodiments described above are merely illustrative, and the device of the present application can also be implemented in other manners. For example, the division of the units / modules in the above embodiments is merely a logical function division, and the actual implementation can be in another manner. For example, a plurality of units / modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0170] In addition, unless specifically stated, each functional unit / module in each embodiment of the present application can be integrated in one unit / module, or each unit / module can exist physically, or two or more units / modules can be integrated together. The integrated unit / module can be implemented in the form of hardware or in the form of a software program module.

[0171] The integrated unit / module, if implemented in the form of hardware, can be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. The processor can be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, and an ASIC, etc. The storage unit can be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory (RRAM), a dynamic random access memory (DRAM), a static random access memory (SRAM), an enhanced dynamic random access memory (EDRAM), a high-bandwidth memory (HBM), a hybrid memory cube (HMC), etc.

[0172] If the integrated units / modules are implemented in the form of software program modules and sold or used as independent products, they can be stored in a computer readable memory. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a memory and includes a number of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned memory includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0173] In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments. The technical features of the above embodiments can be combined arbitrarily, and in order to make the description concise, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combinations of the technical features do not exist contradictory, they should be considered as the scope of the present application.

[0174] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The application is intended to cover any variations, uses or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice in the art to which the application pertains. The specification and examples are to be regarded as illustrative only, and the true scope and spirit of the application are indicated by the appended claims.

[0175] It should be understood that the present application is not limited to the precise construction that has been described and illustrated herein and that various modifications and changes can be made therein without departing from the scope thereof. The scope of the application is indicated by the appended claims.

Claims

1. An alarm method characterized by, The method comprises: acquiring initial operation data of a device, the initial operation data being located in a first data range; determining an initial data index corresponding to the initial operation data, determining a plurality of associated data indexes corresponding to the initial data index through an association matrix; performing data collection on operation data of the device according to the initial data index and the plurality of associated data indexes, to obtain a plurality of collected data; inputting the initial data index, the plurality of associated data indexes, and the plurality of collected data into an abnormal data prediction model, to obtain an abnormal data index, target abnormal data, and a predicted abnormal time; performing alarm processing according to the abnormal data index, the target abnormal data, and the predicted abnormal time.

2. The method of claim 1, wherein, The association matrix comprises a correlation coefficient matrix and a convergence coefficient matrix; determining the plurality of associated data indexes corresponding to the initial data index through the association matrix comprises: determining a data index library, and determining a plurality of candidate data indexes from the data index library; inputting the initial data index and the plurality of candidate data indexes into the correlation coefficient matrix, to obtain a plurality of initial correlation indexes and a plurality of correlation coefficients corresponding to the plurality of initial correlation indexes; inputting the initial data index and the plurality of candidate data indexes into the convergence coefficient matrix, to obtain a plurality of initial convergence indexes and a plurality of convergence coefficients corresponding to the plurality of initial convergence indexes; determining the plurality of associated data indexes according to the plurality of initial correlation indexes, the plurality of correlation coefficients, the plurality of initial convergence indexes, and the plurality of convergence coefficients.

3. The method of claim 2, wherein, Determining the plurality of associated data indexes according to the plurality of initial correlation indexes, the plurality of correlation coefficients, the plurality of initial convergence indexes, and the plurality of convergence coefficients comprises: determining a plurality of coincident indexes that coincide in the plurality of initial correlation indexes and the plurality of initial convergence indexes; determining a first weight corresponding to the correlation coefficient and a second weight corresponding to the convergence coefficient; for any one coincident index, performing weighted calculation processing on the correlation coefficient and the convergence coefficient of the coincident index according to the first weight and the second weight, to obtain a weight value corresponding to the coincident index; performing sorting processing on the plurality of coincident indexes according to the weight values corresponding to the plurality of coincident indexes respectively, to obtain an index sequence; determining the plurality of associated data indexes from the index sequence.

4. The method according to any one of claims 1-3, characterized in that, Performing data collection on operation data of the device according to the initial data index and the plurality of associated data indexes, to obtain a plurality of collected data, comprises: determining a collection time period; generating a timing task according to the collection time period; performing timing data collection according to the initial data index and the plurality of associated data indexes through the timing task, to obtain the plurality of collected data.

5. The method according to any one of claims 1-3, characterized in that, Performing data collection on operation data of the device according to the initial data index and the plurality of associated data indexes, to obtain a plurality of collected data, comprises: determining a collection time period and a time series database, the time series database comprising a plurality of time series data, and data indexes and collection time points corresponding to the plurality of time series data respectively; According to the collection time period, the initial data index, and the plurality of associated data indexes, a plurality of collection data is determined from the time series database, wherein each collection data corresponds to the initial data index or any one of the associated data indexes, and each collection data corresponds to a collection time point within the collection time period.

6. The method of claim 1, wherein, According to the abnormal data index, the abnormal data, and the predicted abnormal time, an alarm processing is performed, including: determining a multi-level alarm mapping table corresponding to the abnormal data index, the multi-level alarm mapping table including a plurality of second data ranges and a plurality of alarm levels; determining a target data range corresponding to the target abnormal data in the plurality of second data ranges in the multi-level alarm mapping table; determining a target alarm level corresponding to the target data range in the multi-level alarm mapping table as a target alarm level; generating alarm information according to the target abnormal data, the predicted abnormal time, and the target alarm level, and performing alarm processing according to the alarm information.

7. The method of claim 6, wherein, According to the target abnormal data, the predicted abnormal time, and the target alarm level, an alarm information is generated, including: determining a strategy mapping table corresponding to the abnormal data index, the strategy mapping table including a plurality of abnormal data, a plurality of alarm levels, and a plurality of optimization strategies; determining a target optimization strategy corresponding to the target abnormal data and the target alarm level from the strategy mapping table; generating the alarm information according to the target abnormal data, the predicted abnormal time, the target alarm level, and the target optimization strategy.

8. An alarm device, characterized in that including: an acquisition module configured to acquire initial running data of a device, the initial running data being located in a first data range; a determination module configured to determine an initial data index corresponding to the initial running data, and determine a plurality of associated data indexes corresponding to the initial data index through an association matrix; a collection module configured to collect running data of the device according to the initial data index and the plurality of associated data indexes, and obtain a plurality of collection data; a prediction module configured to input the initial data index, the plurality of associated data indexes, and the plurality of collection data into an abnormal data prediction model, and obtain an abnormal data index, target abnormal data, and a predicted abnormal time; an alarm module configured to perform alarm processing according to the abnormal data index, the target abnormal data, and the predicted abnormal time.

9. An electronic device, comprising: including: a processor, and a memory in communication connection with the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method according to any one of claims 1 to 7.

11. A computer program product, characterised in that, including a computer program, which is executed by the processor to implement the method according to any one of claims 1 to 7.

Images