Computer fault alarm system

Abstract

The invention discloses a computer fault alarm system, which belongs to the field of computer safety monitoring and comprises an acquisition processing module, a feature fusion module, a fault prediction module, an event identification module, a root cause analysis module, a context awareness module, an aggregation grading module, an alarm pushing module and a repair execution module. According to the method, potential abnormal modes can be effectively captured, report omission is reduced, the expression ability and prediction accuracy of complex modes are improved, fault modeling requirements in a complex calculation environment can be met, fault sources can be accurately positioned, propagation paths can be presented, positioning efficiency and transparency are improved, alarm flooding is avoided, and it is ensured that high-risk events are processed preferentially.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer security monitoring, in particular to a computer fault alarm system. BACKGROUND

[0002] With the increasing complexity and heterogeneity of modern computer systems, traditional fault monitoring and alarm mechanisms have been difficult to meet the needs of high availability and high reliability systems. Large-scale distributed architecture, micro-service deployment, and multi-element software and hardware stack introduce a large amount of high-dimensional, unstructured, and strongly time-series running data. These data often have weak abnormal signals that are difficult to detect but can be mined before the system performance degrades or fails. However, traditional alarm mechanisms generally rely on static thresholds, single indicators, and independent analysis, resulting in high false alarm rates, serious missed reports, difficult positioning, and slow processing, which seriously restricts the stable operation and operational efficiency of the system. At the same time, as businesses place higher demands on service continuity, SLA compliance, and automatic recovery capabilities, relying solely on manual experience analysis cannot meet the challenges posed by system complexity. Therefore, we propose a computer fault alarm system.

[0003] After searching, Chinese Patent No. CN114676022A discloses a computer fault alarm system. The invention can accurately monitor the parameter data affecting the computer fault through the induction module, control module and fault processing module, and can analyze the parameter data and perform corresponding actions to protect the normal operation of the computer. However, it cannot capture potential abnormal patterns, increasing the probability of missed reports, reducing the expression ability and prediction accuracy of complex patterns, and cannot adapt to the fault modeling needs in complex computing environments, reducing positioning efficiency and transparency, and there is a situation of alarm flooding. Therefore, we propose a computer fault alarm system. SUMMARY

[0004] The purpose of the present application is to solve the defects in the prior art and propose a computer fault alarm system.

[0005] In order to achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0006] A computer fault alarm system includes a collection and processing module, a feature fusion module, a fault prediction module, an event identification module, a root cause analysis module, a context awareness module, an aggregation and classification module, an alarm push module, and a repair execution module.

[0007] The collection and processing module is used to collect multiple types of data in the computer in real time and to preliminarily process the collected data of each type.

[0008] The feature fusion module is used to fuse the features of multiple types of data.

[0009] The fault prediction module predicts the fault of the computer according to the feature fusion result;

[0010] The event identification module identifies an abnormal event with actual risk according to the prediction result and the current computer state;

[0011] The root cause analysis module is used for a pre-constructed fault atlas, and deduces a fault root node according to the identified abnormal event;

[0012] The context perception module is used for real-time perception of computer running environment and operation and maintenance information;

[0013] The aggregation and classification module aggregates and classifies the original alarm according to the root cause analysis result and the perceived information;

[0014] The alarm pushing module pushes the alarm to the target object in different ways according to the aggregation and classification result;

[0015] The repair execution module is used for automatically executing the computer repair operation according to the pre-defined repair script.

[0016] As a further scheme of the application, the specific steps of the collection and processing module for the preliminary processing of the collected various types of data are as follows:

[0017] S1.1: The sampling frequency and the time stamp of different data sources are counted, and the data of different data sources are sorted in ascending order according to the collection frequency of each data source, and the data at the 25% position and the 75% position of each sorted group of data are selected and taken as the lower quartile and the upper quartile of each group of data;

[0018] S1.2: The interquartile range is calculated according to the lower quartile and the upper quartile, and the upper and lower thresholds for judging abnormal data are set based on the lower quartile, the upper quartile and the interquartile range, the data exceeding the upper abnormal threshold and the data lower than the lower abnormal threshold are marked as abnormal values, and the marked abnormal values are replaced by the median;

[0019] S1.3: The processed each group of data is normalized by Z-score standardization processing, so that the mean value of each group of data features is 0 and the standard deviation is 1, and the principal component analysis method is used to project the high-dimensional features to a low-dimensional space to remove redundant data in each group of data.

[0020] As a further scheme of the application, the specific steps of the feature fusion module for fusing the feature information of the data of different data sources are as follows:

[0021] S2.1: a fixed-length sliding window is constructed, and the step size and starting point of the sliding window are set, then the sliding window is moved step by step according to the preset step size, and the feature information of each data source data after preprocessing is generated respectively, and each feature information is vectorized by using an encoder function;

[0022] S2.2: the processed feature vectors are mapped to an attention score space, and the attention scores of different time points of each feature vector are obtained, and then the attention scores of all feature vectors are normalized by Softmax;

[0023] S2.3: based on the normalized attention scores of each time point, the feature vectors of the corresponding time points are weighted and fused, and the joint features corresponding to different time points are generated, and then the dimensionality of each joint feature is reduced, and the final fusion feature of each time point is generated.

[0024] As a further scheme of the present application, the specific steps of the fault prediction module for predicting the fault of the computer are as follows:

[0025] S3.1: collect each historical fusion feature, and mark the corresponding time position encoding vector of each historical fusion feature, divide the processed historical fusion feature into a training set, a validation set and a test set, establish a fault analysis model based on a Transformer model architecture, and set the network layer number and parameters of the fault analysis model;

[0026] S3.2: divide the training set into multiple batches of small batch training samples, and input each training sample into the fault analysis model in turn, and pass each group of training samples layer by layer through the forward propagation algorithm, and each attention head of the attention layer in the fault analysis model calculates the query, key and value of each training sample;

[0027] S3.3: according to the query, key and value, the attention weight of different attention heads and the output representation of the current training sample are calculated, the output representation of the corresponding training sample is spliced according to the attention weight, and the output representation of each time step after splicing is nonlinearly transformed and the feature is improved, then the output representation of each time step after processing is residual connected and layer normalized, and the output representation after processing is input into a probability prediction head to output the fault probability in a preset time period;

[0028] S3.4: according to the processed output representation, the fault type of the current computer state is predicted using a softmax classifier, and the output fault probability and fault type are integrated to generate the final prediction result, and then the loss value between the prediction result and the true result is calculated using a cross-entropy function;

[0029] S3.5: input the loss value into the fault prediction model through the back propagation algorithm, calculate the gradient of the loss value for each network layer, and update and adjust the parameters of each network layer in the fault prediction model using the Adam optimizer;

[0030] S3.6: after each round of training, input the verification set into the fault prediction model, obtain the loss value of the fault prediction model on the verification set, and if the loss value is higher than the preset threshold, retrain the fault detection model until the loss value of the fault detection model on the verification set is lower than the preset threshold, and test the performance of the trained fault detection model using the test set;

[0031] S3.7: transmit the latest fusion features to the trained fault detection model, then the fault detection model processes the latest fusion features layer by layer, and outputs the current computer fault occurrence probability and fault type, while calculating the loss value of the prediction result and the true result in real time, if the loss value is higher than the preset threshold, retrain the fault detection model.

[0032] As a further scheme of the present application, the specific steps of the root cause analysis module pre-constructed fault atlas are as follows:

[0033] S4.1: extract hardware components, software services, configuration items, fault types and log templates from existing computer documents, configuration files and log descriptions, and structure the extracted concept information to establish corresponding entities, and take each group of entities as nodes;

[0034] S4.2: build the dependency, call, ownership, causality and trigger relationship between each entity through rule matching, natural language processing and expert annotation, and take the relationship between each entity as an edge, and based on the entity and the corresponding relationship edge, establish a triple of the form of entity-edge-entity;

[0035] S4.3: according to the constructed each group of entities and relationship triplets, establish the corresponding directed graph structure, and store the directed graph structure into the Neo4j graph database to generate the corresponding fault atlas.

[0036] As a further scheme of the present application, the specific steps of the aggregation and grading module for the original alarm are as follows:

[0037] S5.1: obtain each fault root node based on the fault atlas, calculate the association probability of each fault root node and each alarm event, calculate the context factors that affect the alarm severity under the current system running environment obtained by the situation awareness module, and establish the corresponding situation awareness vector;

[0038] S5.2: The alarm events belonging to the same fault root node are aggregated into a main alarm, then the severity score corresponding to each main alarm is calculated by the Sigmoid function, then the main alarm is divided into three levels of high, medium and low according to the preset threshold, and the push channel and responsible person are specified.

[0039] Compared with the prior art, the present application has the following advantages:

[0040] The present application extracts features from multi-source time series data through a sliding window mechanism, fuses each feature information using an encoder and attention mechanism, and constructs a fault prediction model. The fault prediction model is iteratively updated using cross-entropy loss and Adam optimizer. After training, the computer fault probability and type are output in real time. At the same time, the concepts of hardware, software, configuration and fault are extracted from system documents and logs, and the relationship between entities and individual entities is constructed to form a fault atlas and store it in a Neo4j graph database. According to the reasoning result of the fault atlas and the context awareness information, the association probability of the alarm and the root cause is calculated, the same source alarm is aggregated into a main alarm, the severity is evaluated by the Sigmoid function, and the hierarchical push is performed. It can effectively capture potential abnormal patterns, reduce false alarms, improve the expression ability and prediction accuracy of complex patterns, adapt to the fault modeling needs in complex computing environments, accurately locate the fault root cause and present the propagation path, improve the positioning efficiency and transparency, avoid alarm flooding, and ensure that high-risk events are handled first. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings are used to provide a further understanding of the present application, and constitute a part of the specification, together with the embodiments of the present application, to explain the present application, and do not constitute a limitation of the present application.

[0042] Figure 1 A system block diagram of a computer fault alarm system according to the present application is provided. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments.

[0044] Embodiment 1

[0045] Reference Figure 1 A computer fault alarm system includes a collection and processing module, a feature fusion module, a fault prediction module, an event identification module, a root cause analysis module, a context awareness module, an aggregation and grading module, an alarm push module, and a repair execution module.

[0046] The data acquisition and processing module is used to acquire various types of data from the computer in real time and to perform preliminary processing on the acquired data.

[0047] Specifically, the sampling frequency and timestamps of different data sources are statistically analyzed. Based on the sampling frequency of each data source, the data from each data source are sorted in ascending order. The 25th and 75th percentiles of each sorted data group are selected and used as the lower and upper quartiles of each data group. The interquartile range is calculated based on the lower and upper quartiles. Then, based on the lower and upper quartiles and the interquartile range, upper and lower thresholds for judging outliers are set. Data exceeding the upper threshold and falling below the lower threshold are marked as outliers. The marked outliers are replaced with the median. Z-score standardization is used to normalize the processed data to make the mean of each data group 0 and the standard deviation 1. Principal component analysis is used to project high-dimensional features into a low-dimensional space to remove redundant data in each data group.

[0048] The feature fusion module is used to perform feature fusion on multiple types of data.

[0049] Specifically, a fixed-length sliding window is constructed, and its step size and starting point are set. Then, according to the preset step size, the sliding window is moved step by step to generate feature information of each preprocessed data source. The encoder function is used to vectorize each feature information. The processed feature vectors are mapped to an attention score space to obtain the attention scores of each feature vector at different time points. Then, the attention scores of all feature vectors are subjected to Softmax normalization. Based on the normalized attention scores at each time point, the feature vectors at the corresponding time points are weighted and fused to generate joint features corresponding to different time points. Finally, feature dimensionality reduction and nonlinear transformation are performed on the generated joint features to generate the final fused features at each time point.

[0050] The fault prediction module predicts computer faults based on the feature fusion results.

[0051] Specifically, historical fusion features are collected, and the corresponding time position encoding vectors of each historical fusion feature are labeled. The processed historical fusion features are divided into training, validation, and test sets. Based on the Transformer model architecture, a fault analysis model is established, and the number of network layers and parameters of the fault analysis model are set. The training set is divided into multiple batches of small-batch training samples, and each training sample is input into the fault analysis model in sequence. Through the forward propagation algorithm, each group of training samples is passed layer by layer. Each attention head in the attention layer of the fault analysis model calculates the query, key, and value of each training sample. Based on each query, key, and value, the attention weights of different attention heads and the output representation of the current training sample are calculated. The output representation of the corresponding training sample is concatenated according to each attention weight. Then, the concatenated output representation at each time step is subjected to nonlinear transformation and feature enhancement. After processing, the output representations of each time step are subjected to residual connection and layer normalization. The processed output representation is then input into a probability prediction head to output the probability of fault occurrence within a preset time period. Based on the processed output representations, s is used The oftmax classifier predicts the fault type of the current computer state and integrates the output fault occurrence probability and fault type to generate the final prediction result. Then, the cross-entropy function is used to calculate the loss value between the predicted and actual results. This loss value is then input into the fault prediction model via backpropagation, and the gradient of the loss value with respect to each network layer is calculated. Simultaneously, the Adam optimizer is used to update and adjust the parameters of each network layer in the fault prediction model. After each training round, a validation set is input into the fault prediction model, and the loss value of the fault prediction model on the validation set is obtained. If the loss value is higher than a preset threshold, the fault detection model is retrained until the loss value of the fault detection model on the validation set is lower than the preset threshold. The performance of the trained fault detection model is then tested using a test set. The latest fused features are transferred to the trained fault detection model, which then processes the latest fused features layer by layer and outputs the current computer fault occurrence probability and fault type. Simultaneously, the loss value between the predicted and actual results is calculated in real time. If the loss value is higher than a preset threshold, the fault detection model is retrained.

[0052] Example 2

[0053] Reference Figure 1 A computer fault alarm system includes a data acquisition and processing module, a feature fusion module, a fault prediction module, an event recognition module, a root cause analysis module, a context awareness module, an aggregation and grading module, an alarm push module, and a repair execution module.

[0054] The event identification module identifies abnormal events with actual risks based on the prediction results and the current computer status; the root cause analysis module is used to construct a fault map and deduce the root cause nodes of the fault based on the identified abnormal events.

[0055] Specifically, from existing computer documentation, configuration files, and log descriptions, concepts such as hardware components, software services, configuration items, fault types, and log templates are extracted. The extracted concept information is then structured to establish corresponding entities. Each group of entities is used as a node, and through rule matching, natural language processing, and expert annotation, dependency, invocation, attribution, causal, and triggering relationships between entities are constructed. The relationships between entities are used as edges, and based on entities and corresponding relationship edges, corresponding entity-edge-entity triples are established. Based on the constructed entity and relationship triples, a corresponding directed graph structure is established and stored in the Neo4j graph database to generate the corresponding fault map.

[0056] The context awareness module is used to perceive the computer's operating environment and maintenance information in real time; the aggregation and classification module aggregates and classifies the original alarms based on the root cause analysis results and the perceived information.

[0057] Specifically, based on the fault map, each fault root cause node is obtained, and the correlation probability between each fault root cause node and each alarm event is calculated. At the same time, the context factors that affect the severity of the alarm under the current system operating environment obtained by the context awareness module are calculated, and a corresponding context awareness vector is established. Alarm events belonging to the same fault root cause node are aggregated into a main alarm. Then, the severity score corresponding to each main alarm is calculated by the Sigmoid function. After that, according to the preset threshold, the main alarms are divided into three levels: high, medium and low, and the push channels and responsible personnel are specified.

[0058] The alarm push module pushes alarms to the target object in different ways based on the aggregation and classification results; the repair execution module is used to automatically perform computer repair operations according to predefined repair scripts.

Claims

1. A computer fault alarm system, characterized in that, It includes a data acquisition and processing module, a feature fusion module, a fault prediction module, an event recognition module, a root cause analysis module, a context awareness module, an aggregation and grading module, an alarm push module, and a repair execution module; The data acquisition and processing module is used to acquire data from different data sources in the computer in real time and to perform preliminary processing on the acquired data of various types. The feature fusion module is used to fuse feature information from data sources different from different data sources; The fault prediction module predicts faults in the computer based on the feature fusion results. The event recognition module identifies abnormal events with actual risks based on the prediction results and the current computer status. The root cause analysis module is used to construct a pre-built fault map and deduce the root cause nodes of the fault based on the identified abnormal events. The context-aware module is used to perceive the computer's operating environment and maintenance information in real time. The aggregation and grading module aggregates and grades the original alarms based on the root cause analysis results and perception information; The alarm push module pushes alarms to the target object in different ways based on the aggregation and classification results; The repair execution module is used to automatically perform computer repair operations based on predefined repair scripts.

2. The computer fault alarm system according to claim 1, characterized in that, The specific steps of the acquisition and processing module in performing preliminary processing on the acquired data of various types are as follows: S1.1: Statistically determine the sampling frequency and timestamp of different data sources. Based on the sampling frequency given to each data source, sort the data from different data sources in ascending order. Select the data at the 25th and 75th percentiles of each sorted data group and use them as the lower and upper quartiles of each data group. S1.2: Calculate the interquartile range based on the lower quartile and the upper quartile. Then, based on the lower quartile, the upper quartile, and the interquartile range, set upper and lower thresholds for judging abnormal data. Mark data that exceed the upper threshold and fall below the lower threshold as abnormal values, and replace each marked abnormal value with the median. S1.3: Z-score standardization is used to normalize the processed data of each group so that the mean of each data feature is 0 and the standard deviation is 1. Principal component analysis is used to project the high-dimensional features into the low-dimensional space to remove redundant data in each group.

3. A computer fault alarm system according to claim 2, characterized in that, The specific steps of the feature fusion module in fusing feature information from different data sources are as follows: S2.1: Construct a sliding window of fixed length, and set the step size and starting point of the sliding window. Then, according to the preset step size, move the sliding window step by step to generate feature information of each preprocessed data source. Use the encoder function to vectorize each feature information. S2.2: Map each of the processed feature vectors to an attention score space to obtain the attention scores of each feature vector at different time points. Then, perform Softmax normalization on the attention scores of all feature vectors. S2.3: Based on the normalized attention scores at each time point, the feature vectors at the corresponding time points are weighted and fused to generate joint features corresponding to different time points. Then, the generated joint features are subjected to feature dimensionality reduction and nonlinear transformation to generate the final fused features at each time point.

4. A computer fault alarm system according to claim 3, characterized in that, The specific steps by which the fault prediction module performs fault prediction on the computer are as follows: S3.1: Collect all historical fusion features and label the corresponding time position encoding vectors of each historical fusion feature. Divide the processed historical fusion features into training set, validation set and test set. Based on the Transformer model architecture, establish a fault analysis model and set the number of network layers and parameters of the fault analysis model. S3.2: Divide the training set into multiple batches of small training samples, and input each training sample into the fault analysis model in sequence. Through the forward propagation algorithm, pass each group of training samples layer by layer. Each attention head of the attention layer in the fault analysis model calculates the query, key and value of each training sample respectively. S3.3: Based on each query, key, and value, calculate the attention weights of different attention heads and the output representation of the current training sample. Concatenate the output representation of the corresponding training sample according to each attention weight. Then, perform nonlinear transformation and feature enhancement on the concatenated output representation at each time step. After processing, perform residual connection and layer normalization on the output representation of each time step. Input the processed output representation into a probability prediction head to output the probability of fault occurrence within a preset time period. S3.4: Based on the processed output representations, use a softmax classifier to predict the fault type of the current computer state, and integrate the output fault occurrence probability and fault type to generate the final prediction result. Then, use the cross-entropy function to calculate the loss value between the prediction result and the actual result. S3.5: The loss value is input into the fault prediction model through the backpropagation algorithm, and the gradient of the loss value with respect to each network layer is calculated. At the same time, the Adam optimizer is used to update and adjust the parameters of each network layer in the fault prediction model. S3.6: After each round of training, input the validation set into the fault prediction model and obtain the loss value of the fault prediction model on the validation set. If the loss value is higher than the preset threshold, retrain the fault detection model until the loss value of the fault detection model on the validation set is lower than the preset threshold, and use the test set to test the performance of the trained fault detection model. S3.7: The latest fused features are transmitted to the fault detection model after training. The fault detection model then processes the latest fused features layer by layer and outputs the probability of the current computer fault and the fault type. At the same time, the loss value between the prediction result and the actual result is calculated in real time. If the loss value is higher than the preset threshold, the fault detection model is retrained.

5. A computer fault alarm system according to claim 1, characterized in that, The specific steps of the fault map pre-constructed by the root cause analysis module are as follows: S4.1: Extract the concepts of hardware components, software services, configuration items, fault types and log templates from existing computer documents, configuration files and log descriptions, and perform structured processing on the extracted concept information to establish corresponding entities, while treating each group of entities as nodes. S4.2: Through rule matching, natural language processing and expert annotation, construct the dependency, invocation, attribution, causal and triggering relationships between entities, and use the relationships between entities as edges. Based on entities and corresponding relationship edges, establish triples in the form of corresponding entity-edge-entity. S4.3: Based on the constructed entity and relation triplets, establish the corresponding directed graph structure and store the directed graph structure in the Neo4j graph database to generate the corresponding fault map.

6. A computer fault alarm system according to claim 5, characterized in that, The specific steps by which the aggregation and classification module aggregates and classifies the original alarms are as follows: S5.1: Based on the fault map, obtain each fault root source node, calculate the association probability between each fault root source node and each alarm event, and at the same time calculate the context factors that affect the severity of the alarm under the current system operating environment obtained by the context awareness module, and establish the corresponding context awareness vector. S5.2: Aggregate alarm events belonging to the same fault root cause node into a main alarm, then calculate the severity score corresponding to each main alarm using the Sigmoid function, and then classify the main alarm into three levels: high, medium and low according to the preset threshold, and specify the push channel and responsible personnel.

Images