Alarm noise reduction method based on large model and reinforcement learning cooperation and related equipment

By employing a collaborative alarm noise reduction method based on large models and reinforcement learning, the problems of false alarms and redundant information in video surveillance systems are solved, achieving efficient alarm information processing and improving the overall operational efficiency and emergency response capabilities of security systems.

CN121350017BActive Publication Date: 2026-04-21BEIJING TIANFANG SECURITY TECH CO LTD
View PDF 1 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2025-12-18
Publication Date
2026-04-21

AI Technical Summary

Technical Problem

Existing video surveillance systems suffer from numerous false alarms, duplicate alarms, and redundant information, resulting in low operating efficiency and difficulty in effectively identifying real security threats.

Method used

We employ a collaborative alarm denoising method based on large models and reinforcement learning. By classifying and preprocessing alarm information, we construct a target denoising model with a dual-tower cross-attention structure and a root cause comparison reward mechanism. This enables semantic understanding and temporal feature capture of alarm information, thereby optimizing the decision-making process.

Benefits of technology

It significantly improves the signal-to-noise ratio of alarms, accurately filters out false alarms, duplicate alarms and redundant information, and improves the operating efficiency and emergency response capability of security systems.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN121350017B_ABST
    Figure CN121350017B_ABST
Patent Text Reader

Abstract

The application discloses an alarm noise reduction method based on a large model and reinforcement learning cooperation and related equipment, and relates to the technical field of alarm noise reduction in video monitoring. The method comprises the following steps: collecting alarm information in a video monitoring system, and classifying the alarm information according to the danger levels of the alarm information; performing data preprocessing on the classified alarm information to obtain alarm training data; training a preset alarm base model by using the alarm training data to obtain a target alarm model; constructing a target noise reduction model based on semantic understanding output of the target alarm model; inputting alarm information to be reduced into the target alarm model to obtain a semantic understanding result; and performing decision optimization on the semantic understanding result based on the target noise reduction model to obtain target alarm information. The technical scheme provided by the application can improve the overall operation efficiency and emergency response capability of a security system.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This application relates to the field of alarm noise reduction technology in video surveillance, specifically to an alarm noise reduction method and related equipment based on a large model and reinforcement learning collaboration. Background Technology

[0002] With the widespread application of video surveillance systems and the continuous expansion of network scale, tens of thousands of various sensing devices (such as cameras and sensors) and security monitoring devices (such as intrusion detection, firewalls, log analysis, and traffic analysis) continuously generate a large number of alarm events. These alarm messages contain both real security threats and a large number of false alarms, duplicate alarms, low-value or redundant information. Currently, security personnel face a serious problem of "alarm fatigue," making it difficult to identify truly threatening events in a timely manner, which severely impacts the overall operational efficiency and emergency response capabilities of security systems.

[0003] Currently, in the field of video surveillance alarm processing, rule-based filtering and statistical analysis are commonly used to process alarm information. These methods primarily determine the validity of alarms through pre-set thresholds and rules, and then filter them based on the statistical characteristics of historical data. However, in practical applications, it has been found that due to the complexity and dynamic nature of video surveillance scenarios, relying solely on fixed rules and simple statistical analysis is insufficient to accurately identify real security threats. These threats often include a large number of false alarms, duplicate alarms, low-value or redundant information, thus severely impacting the overall operational efficiency and emergency response capabilities of security systems. Summary of the Invention

[0004] This application provides an alarm noise reduction method and related equipment based on large model and reinforcement learning collaboration, which can improve the overall operating efficiency and emergency response capability of security systems.

[0005] Firstly, this application provides an alarm denoising method based on a large model and reinforcement learning collaboration, the method comprising:

[0006] Collect alarm information from the video surveillance system and classify the alarm information according to the degree of danger of each alarm information;

[0007] The alarm information after classification is preprocessed to obtain alarm training data;

[0008] The target alarm model is obtained by training the preset alarm base model using the alarm training data.

[0009] A target noise reduction model is constructed based on the semantic understanding output of the target alarm model;

[0010] The alarm information to be denoised is input into the target alarm model to obtain the semantic understanding result;

[0011] Based on the target denoising model, the semantic understanding results are optimized to obtain target alarm information.

[0012] By adopting the above technical solution, the alarm information generated by the video surveillance system is first classified according to its degree of danger, providing a priority basis for subsequent alarm processing. Then, standardized alarm training data is obtained through data preprocessing. This data is used to fine-tune the basic alarm model, enabling the model to better understand and process alarm information in specific scenarios. Based on the output of the fine-tuned model, the system constructs a target denoising model with a dual-tower cross-attention structure. This model captures the semantic correlation and temporal features of alarms through semantic towers and temporal towers, respectively. When new alarm information needs to be processed, the system first uses the target alarm model to obtain its semantic understanding results, and then the target denoising model performs decision optimization based on a root cause comparison reward mechanism, thereby effectively identifying and retaining real security threat alarms. This processing method based on large models and reinforcement learning overcomes the limitations of traditional rule-based and statistical analysis methods, accurately filtering out false alarms, duplicate alarms, low-value and redundant information, and significantly improving the signal-to-noise ratio of alarms.

[0013] Optionally, alarm information from the video surveillance system can be collected, and the alarm information can be classified according to the degree of danger of each alarm information;

[0014] The alarm information after classification is preprocessed to obtain alarm training data;

[0015] The target alarm model is obtained by training the preset alarm base model using the alarm training data.

[0016] A target noise reduction model is constructed based on the semantic understanding output of the target alarm model;

[0017] The alarm information to be denoised is input into the target alarm model to obtain the semantic understanding result;

[0018] Based on the target denoising model, the semantic understanding results are optimized to obtain target alarm information.

[0019] Optionally, the step of training a preset alarm base model using the alarm training data to obtain a target alarm model includes:

[0020] The alarm training data is converted into a prompt-response binary format;

[0021] The cue-response pairs are divided using a stratified sampling strategy to form a training set, a validation set, and a test set.

[0022] Construct a low-rank adaptation matrix, which is used to inject domain-preset knowledge while retaining the original knowledge of the alarm base model;

[0023] The training set is used to fine-tune the parameters of the alarm base model. During the fine-tuning process, the low-rank adaptation matrix is ​​used to adjust the model weights, and the validation set is used to evaluate the intermediate results of the fine-tuning and dynamically adjust the fine-tuning parameters.

[0024] The performance of the fine-tuned alarm base model is evaluated using the test set. If the performance does not meet the preset standard, the model is retrained until the performance meets the preset standard, thus obtaining the target alarm model.

[0025] Optionally, adjusting the model weights using the low-rank adaptation matrix during fine-tuning includes:

[0026] Determine the rank parameter of the low-rank adaptation matrix, wherein the rank parameter is less than the dimension of the original weight matrix of the alarm base model;

[0027] The low-rank adaptation matrix is ​​decomposed into two factor matrices, and the decomposed factor matrices are applied to the weight matrix of each layer of the alarm base model to obtain the adjusted weight matrix.

[0028] The influence of the factor matrix on the original weights is adjusted according to a preset scaling factor. The model forward calculation is performed based on the adjusted weight matrix, while the original weights of the alarm base model are frozen.

[0029] The factor matrix is ​​updated using gradients based on the forward computation results, and preset parameters such as training batch size, gradient accumulation steps, and learning rate are applied during the gradient update process.

[0030] Optionally, the construction of the target denoising model includes a first stage and a second stage, wherein the construction of the target denoising model based on the semantic understanding output of the target alarm model includes:

[0031] In the first stage, a dual-tower cross-attention structure is constructed based on the semantic understanding output of the target alarm model. The dual-tower cross-attention structure includes a semantic tower for extracting deep semantics and a temporal tower for capturing temporal features.

[0032] In the second stage, a root cause comparison-based reward mechanism is constructed, which is used to evaluate decision quality and guide model optimization;

[0033] The dual-tower cross-attention structure is integrated with the reward mechanism to form a target noise reduction model with alarm noise reduction capability.

[0034] Optionally, constructing a dual-tower cross-attention structure based on the semantic understanding output of the target alarm model in the first stage includes:

[0035] The semantic understanding output of the target alarm model is used as the initial feature input to construct a semantic tower containing self-attention computing units;

[0036] Temporal information is extracted from the semantic understanding output of the target alarm model to construct a temporal tower containing temporal convolutional units;

[0037] The semantic features output by the semantic tower and the temporal features output by the temporal tower are concatenated after layer normalization.

[0038] The spliced ​​features are subjected to dimensionality reduction to obtain fused features, and the dual-tower cross-attention structure is constructed based on the fused features.

[0039] Optionally, the step of constructing a root cause comparison-based reward mechanism in the second stage includes:

[0040] In the alarm information, the set of alarms marked as root cause events is defined as positive samples, and the remaining set of non-root cause alarms is defined as negative samples.

[0041] A root cause comparison reward item is constructed, which is obtained by calculating the logarithm of the ratio of positive samples to negative samples.

[0042] A latency-based penalty term is determined, which increases as the alarm processing latency increases;

[0043] By combining the root cause comparison reward and the penalty, an overall reward function is constructed, and the parameter update of the dual-tower cross-attention structure is guided by the overall reward function.

[0044] A second aspect of this application provides an electronic device for alarm denoising based on a large model and reinforcement learning collaboration, the electronic device comprising: one or more processors and a memory; the memory being coupled to the one or more processors, the memory being used to store computer program code including computer instructions, the one or more processors calling the computer instructions to cause the electronic device for alarm denoising based on a large model and reinforcement learning collaboration to perform the method described in the first aspect and any possible implementation thereof.

[0045] A third aspect of this application provides a computer program product containing instructions that, when run on an electronic device for alarm noise reduction based on a large model and reinforcement learning collaboration, causes the electronic device to perform the method described in the first aspect and any possible implementation thereof.

[0046] A fourth aspect of this application provides a computer-readable storage medium including instructions that, when executed on an electronic device for alarm noise reduction based on a large model and reinforcement learning collaboration, cause the electronic device to perform the methods described in the first aspect and any possible implementation thereof.

[0047] In summary, one or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0048] This application first classifies the danger level of alarm information generated by the video surveillance system, providing a priority basis for subsequent alarm processing. Then, standardized alarm training data is obtained through data preprocessing. This data is used to fine-tune the basic alarm model, enabling the model to better understand and process alarm information in specific scenarios. Based on the output of the fine-tuned model, the system constructs a target denoising model with a dual-tower cross-attention structure. This model captures the semantic correlation and temporal features of alarms through semantic towers and temporal towers, respectively. When new alarm information needs to be processed, the system first uses the target alarm model to obtain its semantic understanding results, and then the target denoising model performs decision optimization based on a root cause comparison reward mechanism, thereby effectively identifying and retaining real security threat alarms. This processing method based on a large model and reinforcement learning overcomes the limitations of traditional rule-based and statistical analysis methods, accurately filtering out false alarms, duplicate alarms, low-value and redundant information, and significantly improving the signal-to-noise ratio of alarms. Attached Figure Description

[0049] Figure 1 This is a flowchart illustrating an alarm noise reduction method based on the collaboration of large models and reinforcement learning, provided in an embodiment of this application.

[0050] Figure 2 This is a schematic diagram of the structure of a target noise reduction model provided in an embodiment of this application;

[0051] Figure 3 This is a schematic diagram of an exemplary hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0052] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0053] In the description of the embodiments of this application, the words "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design that is described as "for example" or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design options. Rather, the use of the words "for example" or "for instance" is intended to present the relevant concepts in a specific manner.

[0054] In the description of the embodiments of this application, the term "multiple" means two or more. For example, multiple systems means two or more systems, and multiple screen terminals means two or more screen terminals. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0055] Please refer to Figure 1 This paper presents a flowchart illustrating an alarm noise reduction method based on a large model and reinforcement learning collaboration. This method can be implemented using a computer program, a microcontroller, or run on an alarm noise reduction device based on a large model and reinforcement learning collaboration. The computer program can be integrated into the computer device or run as a standalone application. Specifically, the method includes steps 10 to 50, as follows:

[0056] Step 10: Collect alarm information from the video surveillance system and classify the alarm information according to the degree of danger of each alarm.

[0057] In this embodiment of the application, alarm information refers to abnormal event notifications generated by various devices in the video surveillance system (including but not limited to cameras, sensors, intrusion detection devices, firewalls, log analysis devices, traffic analysis devices, etc.).

[0058] Specifically, the first step is to collect alarm information from the video surveillance system. As video surveillance systems expand, various sensing devices (such as cameras and sensors) and security monitoring devices (such as intrusion detection, firewalls, log analysis, and traffic analysis) continuously generate a large number of alarm events. These alarms contain both real security threats and a significant amount of false alarms, duplicate alarms, and redundant information. To achieve effective noise reduction in the subsequent process, these alarms need to be systematically collected and categorized. The system collects alarm information from various devices through a real-time data interface. Each alarm message includes basic fields such as device ID, alarm type, alarm description, and timestamp. After collection, the system categorizes each alarm message according to its level of danger. The danger level is determined based on the potential security impact of the alarm event, dividing alarm information into three levels: high, medium, and low. High-level alarms may lead to serious security incidents, such as unauthorized intrusion detection; medium-level alarms may affect the normal operation of the system, such as abnormal device status; and low-level alarms correspond to general alerts, such as reminders for regular device maintenance.

[0059] This tiered data acquisition mechanism provides a structured and operable data foundation for subsequent noise reduction processing. By classifying alarm information according to its degree of danger, the system can adopt differentiated processing strategies for alarms of different levels, improving the accuracy and efficiency of alarm processing. Simultaneously, this tiered mechanism also helps security personnel quickly identify and respond to high-risk alarm events, effectively alleviating the problem of "alarm fatigue." Furthermore, the tiered alarm information provides more valuable training samples for subsequent model training, contributing to improved performance of the entire noise reduction system.

[0060] Step 20: Perform data preprocessing on the graded alarm information to obtain alarm training data.

[0061] Specifically, in this embodiment, to ensure the effectiveness of subsequent model training, the graded alarm information needs to undergo data preprocessing. Since the original alarm information may have issues such as inconsistent formatting, missing fields, and redundancy, directly using it for model training may affect the model's learning performance; therefore, systematic preprocessing is necessary.

[0062] First, key fields are extracted from the alarm information, including device ID, alarm type, and description text. During extraction, the system standardizes the format of these fields to ensure data consistency. Next, based on the extracted field information, the system performs device correlation analysis to construct a device alarm correlation structure, reflecting the alarm relationships between different devices. Finally, the system performs text normalization processing on the alarm information, including deleting invalid fields and filtering garbled characters.

[0063] To avoid duplicate alarms affecting subsequent processing, the system calculates a checksum for each alarm message. When the checksum of an alarm is the same as one of the most recent 1000 alarm messages, the system marks the alarm as a duplicate (duplicate_flag=1) and deletes it. After completing the redundancy detection, the system converts the processed alarm information into structured data in JSON format, forming the final alarm training data, and stores it in a designated Kafka topic. This structured data format not only preserves the original alarm information but also includes the alarm correlations between devices.

[0064] Through this preprocessing workflow, the system can significantly improve the quality of alarm data. The cleaned data has better consistency and usability, providing high-quality training samples for subsequent model training. Simultaneously, by preserving the correlations between device alarms, the model can better understand and learn the inherent relationships between alarm events, thereby improving noise reduction performance. Furthermore, the structured data format facilitates efficient data processing and storage management by the system.

[0065] As an optional embodiment, the step of preprocessing the graded alarm information to obtain alarm training data may further include the following steps:

[0066] Step 201: Extract key field information from alarm information.

[0067] Specifically, the system first needs to extract key field information from the categorized alarm information, which forms the basis for subsequent processing. The system parses the raw alarm information using a JSON parser, extracting key fields including device ID, alarm type, alarm description, timestamp, and danger level. During extraction, the system validates each field, checking its existence, data type, and value within a reasonable range. For any missing fields, the system supplements them using preset default values. This systematic field extraction ensures data integrity and consistency in subsequent processing.

[0068] Step 202: Perform device association analysis on key field information and establish a device alarm association structure.

[0069] Specifically, the system constructs a device association graph based on device IDs. Nodes in the graph represent devices, and edges represent the relationships between devices. Associations are established based on the following rule: if two devices have generated the same type of alarm within the past 24 hours, or if their alarm interval is less than 5 minutes, then the two devices are considered associated. The system uses an adjacency matrix to store these associations and calculates the association strength between devices using a graph algorithm. This association structure helps the system understand the propagation path and impact range of alarm events.

[0070] Step 203: Perform text normalization processing based on the device alarm association structure.

[0071] Specifically, to improve the quality of text data, the system needs to standardize the alarm description text. First, the system uses natural language processing (NLP) technology to segment and tag the text, identifying key entities and attributes. Then, based on the established device alarm association structure, the system standardizes the alarm description text for related devices, including standardizing device names and alarm type descriptions. Simultaneously, the system removes special characters, handles garbled text, and standardizes time formats. This text standardization based on the association structure ensures the consistency and understandability of the alarm descriptions.

[0072] Step 204: Redundancy detection is performed using the device alarm association structure and the text after text normalization.

[0073] Specifically, the system first calculates a feature vector for each alarm message, which includes the device ID, alarm type, and normalized text features. Then, it uses a locality-sensitive hashing algorithm to calculate the similarity of the most recent 1000 alarm messages. When the similarity between two alarms exceeds a preset threshold (e.g., 0.95), the system further compares their positions within the device alarm association structure. If these alarms originate from related devices and the time interval is less than a preset value, they are marked as redundant alarms. This redundancy detection mechanism based on multi-dimensional features effectively identifies duplicate alarms.

[0074] Step 205: Convert the alarm information after redundancy detection into a structured data format to form alarm training data. The structured data format retains the correlation between device alarms.

[0075] Specifically, finally, the system needs to convert the processed alarm information into a standard structured format. The system uses JSON Schema to define the data structure, including basic fields (such as device ID, alarm type, etc.), association information (such as device association strength, alarm similarity, etc.), and processing marks (such as whether it is a redundant alarm, etc.). During the conversion process, the system will maintain the device-alarm association relationship and encode information such as association strength and propagation path into the structured data. The final training data is stored in JSON format, and each record contains complete alarm information and association relationships. This structured data format not only ensures the integrity of the data but also facilitates subsequent model training and feature extraction.

[0076] Step 30: Train a preset alarm base model with the alarm training data to obtain a target alarm model.

[0077] Among them, the preset alarm base model refers to the large language model Qwen3-8B open-sourced by Alibaba Cloud. This model has approximately 8 billion parameters and supports multiple tasks such as multi-round conversations, instruction understanding, code generation, and text summarization. This model uses a tokenizer based on Byte Pair Encoding (BPE) to convert text into input_ids and attention_mask using the tokenizer, while truncating overly long samples (ensuring they do not exceed max_length).

[0078] Specifically, the system fine-tunes the preset alarm base model Qwen3-8B with the alarm training data. First, convert the JSON data of the alarm information into a "prompt-response" binary tuple format D = {(xi, yi)}, where xi is the input prompt and yi is the expected response. Clean the input text through regular expressions: xi = RegExClean(xi, pattern = \、\?\s). The data is divided into a training set, a validation set, and a test set in a ratio of 7:1:2. During the fine-tuning process, the LoRA method is used to only train a small number of additional parameters and freeze the pre-trained model weights. The core idea of LoRA is to inject a trainable low-rank matrix into the original weight matrix W0: W = W0 + ΔW = W0 + BA, where the rank r << min(d, k). This fine-tuning method significantly reduces the video memory requirements and can be fine-tuned with a single NVIDIA RTX 4090 graphics card configuration, and finally obtains the target alarm model.

[0079] As an optional embodiment, the step of training a preset alarm base model with the alarm training data to obtain a target alarm model may further include the following steps:

[0080] Step 301: Convert the alarm training data into a prompt-response binary tuple format.

[0081] Specifically, the system needs to convert the preprocessed alarm training data into a standard format that the model can process. Specifically, the system converts JSON-formatted alarm data into a "prompt-response" tuple format D = {(xi,yi) |i = 1,2,...N}. Here, xi represents the input prompt, containing basic alarm information and context; yi represents the expected model response, containing the alarm processing result. For each alarm data point, the system first cleans it using regular expressions: xi = RegExClean(xi,pattern =\、\?\s), removing invalid characters and noise. Then, the BPE tokenizer is used to convert the cleaned text into input_ids and attention_mask, ensuring that the sequence length does not exceed the model's max_length limit. This standardized data format conversion ensures the stability and efficiency of the subsequent training process.

[0082] Step 302: Use a stratified sampling strategy to divide the cue-response pairs into training, validation, and test sets.

[0083] Specifically, the system employs a stratified sampling strategy to partition the dataset, ensuring a balanced distribution of alarm samples across different datasets. First, the system stratifies the alarms according to their domain knowledge category K, with each stratum representing a specific alarm type. Then, within each stratum, random sampling is performed according to a preset ratio to construct three datasets: a training set Dtrain = Uk∑Sk (α = 0.7), a validation set Dval = Uk∑Sk (α = 0.1), and a test set Dtest = Uk∑Sk (α = 0.2). Here, Sk(α) represents a subset of samples drawn from the k-th class at a ratio α, ensuring that each dataset contains representative samples of each alarm type. This stratified partitioning strategy guarantees the balance and representativeness of the datasets, providing a reliable data foundation for model training.

[0084] Step 303: Construct a low-rank adaptation matrix. The low-rank adaptation matrix is ​​used to inject domain-preset knowledge while retaining the original knowledge of the alarm base model.

[0085] Specifically, the system constructs a low-rank adaptation matrix to achieve efficient model fine-tuning. Based on the original weight matrix W0, the system constructs a low-rank decomposition matrix BA, where B∈Rd×r represents the dimensionality reduction matrix and A∈Rr×k represents the dimensionality increase matrix. Here, d represents the input dimension of the original weight matrix, k represents the output dimension, and r represents the dimension (rank) after dimensionality reduction. For example, when the original weight matrix has a dimension of 768×768, r=16 can be chosen. In this case, the dimension of B is 768×16, and the dimension of A is 16×768, thus greatly reducing the number of parameters that need to be trained. This low-rank structure is injected into the original model through the weight update formula W = W0 + ΔW = W0 + BA. Here, W0 represents the original weight matrix of the pre-trained model, ΔW represents the weight update amount obtained through low-rank decomposition, and W represents the final weight matrix. To ensure that the low-rank adaptation matrix can effectively capture domain knowledge, the system sets the rank r to be much smaller than min(d,k), typically taking a value of 16 or 32. This low-rank structure design retains the general knowledge of the base model while efficiently injecting alarm processing knowledge specific to the domain, and significantly reduces the number of parameters that need to be trained.

[0086] Step 304: Fine-tune the parameters of the alarm base model using the training set. During the fine-tuning process, use a low-rank adaptation matrix to adjust the model weights, and use the validation set to evaluate the intermediate results of the fine-tuning and dynamically adjust the fine-tuning parameters.

[0087] Specifically, the system uses the LoRA method for model fine-tuning. First, the system divides the training set data into batches of 16, ensuring right alignment of the sequences using left padding. In each training step, the system only updates the parameters of the low-rank adaptation matrix, keeping the original model parameters frozen. The system employs the Adam optimizer with a learning rate of 0.00001 and uses a linear learning rate decay strategy. During training, the system evaluates the model performance on the validation set after processing every 1000 batches. If the validation set loss fails to improve for three consecutive times, the system dynamically adjusts the learning rate or stops training early. Simultaneously, the system maintains a key-value cache to improve training efficiency. This fine-tuning strategy ensures training effectiveness while significantly reducing computational resource requirements.

[0088] Step 305: Use the test set to evaluate the performance of the fine-tuned alarm base model. If the performance does not meet the preset standard, retrain until the performance meets the preset standard to obtain the target alarm model.

[0089] Specifically, the system uses a test set to comprehensively evaluate the fine-tuned model. The system sets multiple performance metrics, including alarm classification accuracy (>90%), alarm priority judgment accuracy (>85%), and model response time (<100ms). During the evaluation process, the system performs inference on each test sample and records each metric. When any metric fails to meet the preset standard, the system adjusts the training parameters (e.g., increasing the number of training epochs, adjusting the learning rate, etc.) and retrains. This iterative optimization process continues until all performance metrics meet the preset standards, ultimately yielding a target alarm model that meets the requirements. This rigorous evaluation and optimization mechanism ensures the reliability of the model in practical applications.

[0090] As an optional embodiment, the step of adjusting the model weights using a low-rank adaptation matrix during fine-tuning may further include the following steps:

[0091] Step 3041: Determine the rank parameter of the low-rank adaptation matrix. The rank parameter is less than the dimension of the original weight matrix of the alarm base model.

[0092] Specifically, the system first needs to determine the rank parameter r of the low-rank adaptation matrix. The original weight matrix of the alarm base model Qwen3-8B has a dimension of d×k (where d=768 is the input dimension and k=768 is the output dimension). To reduce computational complexity and storage overhead, the system sets the rank parameter r to 16, which is much smaller than the original weight matrix dimension min(d,k)=768. This low-rank design significantly reduces the number of parameters that need to be trained, from the original d×k to r×(d+k). For example, for a 768×768 weight matrix, the original number of parameters is 589,824, while using the low-rank structure with r=16 reduces the number of parameters to 24,576, a reduction of approximately 95%, while still maintaining sufficient model expressive power.

[0093] Step 3042: Decompose the low-rank adaptation matrix into two factor matrices, and apply the decomposed factor matrices to the weight matrix of each layer of the alarm base model to obtain the adjusted weight matrix.

[0094] Specifically, the system decomposes the low-rank adaptation matrix ΔW into two factor matrices B and A, where B ∈ Rd×r is the dimensionality-reduced matrix and A ∈ Rr×k is the dimensionality-increasing matrix. For each layer's weight matrix W0, the system applies these two factor matrices using the formula W = W0 + ΔW = W0 + BA. The system initializes these two factor matrices with a normal distribution and sets the initial standard deviation to 0.01 to ensure a small initial weight update. This decomposition method not only reduces the number of parameters but also provides a structured weight update mechanism, helping the model retain existing knowledge while learning new domain features.

[0095] Step 3043: Adjust the influence of the factor matrix on the original weights according to the preset scaling factor, perform forward calculation of the model based on the adjusted weight matrix, and freeze the original weights of the alarm base model at the same time.

[0096] Specifically, the system introduces a scaling factor α (default setting is 8.0) to control the influence of the factor matrix on the original weights. The actual weight update formula is modified to W = W0 + α / r × BA, where r is the rank parameter. During forward propagation, the system sets the original weight matrix W0 of the alarm base model as the parameter requiring gradient updates, ensuring the preservation of the original pre-trained knowledge. In each forward propagation, the system first calculates BA to obtain a low-rank update, then adjusts it according to the scaling factor, and finally adds it to the original weights to obtain the final weight matrix. This scaling mechanism provides fine-grained control over the magnitude of weight updates, contributing to stable model training.

[0097] Step 3044: Update the gradient of the factor matrix based on the forward calculation results. During the gradient update process, the preset training batch size, gradient accumulation steps and learning rate parameters are applied.

[0098] Specifically, the batch size is set to 16, the gradient accumulation steps to 4, and the learning rate to 0.00001. The system uses the AdamW optimizer for parameter updates, which includes the following key parameters:

[0099] β1=0.9: Exponential decay rate of the first moment estimate, used to control the influence of historical gradient information; β2=0.999: Exponential decay rate of the second moment estimate, used to adaptively adjust the learning rate for different parameters; weight_decay=0.01: Weight decay coefficient, used to prevent overfitting by adding an L2 regularization term to the loss function. During each gradient update, the system first calculates the gradient of the loss function with respect to factor matrices B and A, and then performs a parameter update after accumulating the gradients of four batches. Simultaneously, the system applies gradient pruning to limit the norm of the gradient to within 1.0, preventing gradient explosion. This meticulous gradient update strategy ensures the stability and effectiveness of model training.

[0100] Step 40: Construct a target noise reduction model based on the semantic understanding output of the target alarm model.

[0101] Specifically, the system's target denoising model adopts a two-stage architecture to achieve accurate denoising based on semantic understanding and temporal features. In the first stage, the system constructs a dual-tower cross-attention structure based on the semantic understanding output of the target alarm model. This structure includes two key components: a semantic tower and a temporal tower. The semantic tower is responsible for extracting deep semantic representations of alarm information, extracting features from the 768-dimensional vector output by the target alarm model through a multi-layer self-attention mechanism. The temporal tower captures the temporal dependencies of the alarm sequence through a causal convolutional network, with a kernel size of 3 and a stride of 1 to ensure effective capture of local temporal patterns. The two towers fuse features through a cross-attention mechanism, enabling the model to consider both semantic relevance and temporal correlation simultaneously. In the second stage, the system constructs a reward mechanism based on root cause comparison. This mechanism calculates reward values ​​by evaluating the semantic similarity, temporal consistency, and root cause correlation of alarm decisions, which guides model optimization. The system integrates the dual-tower cross-attention structure with the reward mechanism and uses an end-to-end training method to construct a target denoising model with alarm denoising capabilities.

[0102] Please see Figure 2 This is a schematic diagram of the structure of a target noise reduction model provided in an embodiment of this application. The model mainly includes two stages of processing: The first stage is a dual-tower cross-attention structure, which receives the semantic understanding output (feature vector sequence) from the target alarm model as input. This structure contains two parallel feature extraction towers: a semantic tower and a temporal tower. The semantic tower contains a self-attention computation unit for extracting deep semantic features; the temporal tower contains a temporal coding unit for capturing alarm temporal features. The features processed by the dual towers are integrated through a feature fusion module, which sequentially performs normalization, concatenation, and dimensionality reduction operations, and finally outputs a fused state representation s_t_final. The second stage is a root cause comparison-based reward mechanism (RL), which includes two core components: a decision network and a reward function. The decision network receives the fused state representation as input and outputs the alarm decision action (retention / filtering). The reward function calculates decision quality based on three evaluation dimensions: a root cause comparison reward (assessing the accuracy of root cause identification), a latency-based penalty (considering processing efficiency), and a human intervention feedback item (integrating expert experience), ultimately generating a total reward r_t. The system continuously optimizes model performance through a parameter update (guiding model optimization) mechanism, improving the accuracy of alarm denoising. This two-stage structural design fully utilizes the semantic and temporal features of alarms, while simultaneously achieving continuous model optimization through reinforcement learning, effectively improving alarm denoising performance.

[0103] As an optional embodiment, the step of constructing a target denoising model based on the semantic understanding output of the target alarm model may further include the following steps:

[0104] Step 401: In the first stage, a dual-tower cross-attention structure is constructed based on the semantic understanding output of the target alarm model. The dual-tower cross-attention structure includes a semantic tower for extracting deep semantics and a temporal tower for capturing temporal features.

[0105] Specifically, while the finely tuned large language model possesses strong semantic understanding capabilities for alarms, its output still carries the risk of false positives and false negatives, making it difficult to directly use for automated processing. Therefore, in the first stage, the system constructs a dual-tower cross-attention structure based on the semantic understanding output of the target alarm model. This structure comprises two main components: a semantic tower and a temporal tower. The semantic tower extracts deep semantic features from the alarm sequence to ensure accurate understanding of the alarm content; the temporal tower identifies the temporal patterns of alarm occurrence by capturing the temporal dependencies between alarms. The system effectively fuses these two types of features through a hierarchical semantic and temporal coupling approach in the state space, and achieves a comprehensive representation of alarm information through adaptive projection dimensionality reduction. This dual-tower structure design overcomes the limitations of single feature representation, providing a more comprehensive feature foundation for alarm noise reduction.

[0106] Step 402: In the second stage, a root cause comparison-based reward mechanism is constructed to evaluate the quality of decisions and guide model optimization.

[0107] Specifically, to address the lack of dynamic optimization capabilities in traditional alarm handling methods, the system constructs a root cause comparison-based reward mechanism in the second stage. This mechanism guides model optimization by evaluating the quality of alarm denoising decisions, comprehensively considering the semantic similarity, temporal consistency, and root cause correlation of alarms. This root cause comparison-based design helps the model identify causal relationships between alarms, avoiding the accidental deletion of important alarms. Simultaneously, through reward feedback, it continuously optimizes the model's decision-making strategy, enabling the model to adapt to constantly changing alarm patterns.

[0108] Step 403: Integrate the dual-tower cross-attention structure with the reward mechanism to form a target noise reduction model with alarm noise reduction capability.

[0109] Specifically, to achieve accurate alarm noise reduction, the system integrates the dual-tower cross-attention structure in the first stage with the reward mechanism in the second stage to construct an end-to-end target noise reduction model. This two-stage integrated design fully leverages the advantages of the dual-tower structure in feature extraction and achieves dynamic optimization of the decision-making strategy through the reward mechanism. Through the organic combination of feature extraction and decision optimization, the model can not only accurately identify duplicate alarms and false alarms, but also has the ability to continuously learn and optimize, constantly improving its noise reduction performance as the alarm scenario changes.

[0110] As an optional implementation, in the first stage, the step of constructing a dual-tower cross-attention structure based on the semantic understanding output of the target alarm model is as follows:

[0111] Step 4011: Use the semantic understanding output of the target alarm model as the initial feature input to construct a semantic tower containing self-attention computing units.

[0112] Specifically, the system first constructs a semantic tower by using the semantic understanding output of the target alarm model as the initial feature input. The system extracts semantic features from the alarm sequence z_[t-k+1:z_t] within the time window, where t represents the current time, k represents the time window size (set to 10), and z_t represents the alarm feature vector at time t. The calculation of semantic granularity s_t^sem maps the input to a (512*k) dimensional space, where 512 is the feature dimension and k is the time window size. This design preserves the fine-grained semantic information of the alarm sequence. The self-attention computation unit in the semantic tower can capture the semantic relationships between alarms, improving the model's ability to understand alarm content.

[0113] Step 4012: Extract temporal information from the semantic understanding output of the target alarm model and construct a temporal tower containing temporal convolutional units.

[0114] Specifically, the system extracts temporal information from the semantic understanding output of the target alarm model to construct a time-series tower. For each pair of adjacent logs, the relative time difference Δt_i = log10((t_i-t_{i-1}) / s) is calculated, where t_i represents the timestamp of the current alarm, t_{i-1} represents the timestamp of the previous alarm, s represents the time standardization factor, and Δt_i represents the standardized time difference. Simultaneously, the temporal feature difference δ_i = |score_i-score_{i-1}| is calculated, where score_i represents the feature score of the current alarm, score_{i-1} represents the feature score of the previous alarm, and δ_i represents the feature change between adjacent alarms. Finally, the temporal granularity s_t^time = [Δt_i, δ_i]_{i=t-k+1}^t is obtained, representing the temporal feature sequence from time t-k+1 to time t. The temporal convolutional units in the time-series tower process these temporal features to effectively capture the temporal dependencies of the alarm sequence.

[0115] Step 4013: Perform layer normalization on the semantic features output by the semantic tower and the temporal features output by the temporal tower, and then concatenate them.

[0116] Specifically, the system processes the semantic features output by the semantic tower and the temporal features output by the temporal tower, performing feature fusion using `s_t = LayerNorm(concat(s_t^sem,s_t^time))`. Here, `s_t^sem` represents the semantic features output by the semantic tower, `s_t^time` represents the temporal features output by the temporal tower, `concat` represents the feature concatenation operation, `LayerNorm` represents the layer normalization operation, and `s_t` represents the final state representation. This feature processing method maintains the independence of semantic and temporal information while effectively fusing the two types of information.

[0117] Step 4014: Perform dimensionality reduction on the spliced ​​features to obtain fused features, and construct a dual-tower cross-attention structure based on the fused features.

[0118] Specifically, the system employs an adaptive projection method to reduce the dimensionality of the concatenated features. This dimensionality reduction is achieved using the formula `s_t_final = W_proj * s_t`, where `W_proj ∈ R^(512×5138)` represents the projection matrix, 512 represents the target dimension, 5138 represents the original feature dimension, `LoRA-rank = 32` represents the rank parameter for low-rank adaptation, and `s_t_final` represents the final state representation after dimensionality reduction. This design preserves the fine-grained semantic differences of 512×10 while compressing the 5138-dimensional features to 512 dimensions, improving computational efficiency while maintaining information content. Based on the obtained fused features, the system finally constructs a dual-tower cross-attention structure to achieve a comprehensive representation of alarm information.

[0119] As an optional embodiment, the second stage of constructing a root cause comparison-based reward mechanism may further include the following steps:

[0120] Step 4021: In the alarm information, the set of alarms marked as root cause events is defined as positive samples, and the remaining set of non-root cause alarms is defined as negative samples.

[0121] Specifically, in this embodiment, the system uses the set G of alarms labeled as root cause events as positive samples in the alarm information, where G is the set of root cause events. Simultaneously, it uses N noise events as a negative sample set, i.e., the retained non-root cause alarms. This division of positive and negative samples provides a foundation for subsequent comparative learning, enabling the model to learn the distinguishing features between root cause alarms and non-root cause alarms.

[0122] Step 4022: Construct the root cause comparison reward item, which is obtained by calculating the logarithm of the ratio of positive samples to negative samples.

[0123] Specifically, the system constructs a root cause comparison reward term. This reward mechanism is built by calculating the positive sample hit rate ρ_hit = |{g ∈ G|g is the same as the current log}| and the negative sample false alarm rate ρ_false = |{n ∈ N|n is retained}|, where ρ_hit represents the hit rate of the root cause event, g represents an element in the root cause event set G, ρ_false represents the false alarm rate of non-root cause events, n represents an element in the noisy event set N, and |·| represents the cardinality of the set. Based on these metrics, the system constructs a comparison term r_contrast = log(ρ_hit + ε) - log(ρ_false + ε), where r_contrast represents the root cause comparison reward value, ε = 1e-6 is a numerical stability factor to prevent zero values ​​when taking the logarithm, and log represents the natural logarithm operation.

[0124] Step 4023: Determine the latency-based penalty, which increases as alarm processing latency increases.

[0125] Specifically, the system design uses a latency penalty term r_latency = -β_latency * min(latency_ms / 100, 10), where r_latency represents the latency penalty value, β_latency = 0.1 is the latency penalty coefficient, latency_ms represents the alarm processing latency (milliseconds), and the min function ensures that the penalty is capped at 10 times β_latency. This design avoids the penalty term excessively dominating the overall reward by limiting latency to a reasonable range.

[0126] Step 4024: Combine the root cause comparison of reward and penalty items to construct an overall reward function, and use the reward function to guide the parameter update of the dual-tower cross-attention structure.

[0127] Specifically, the system constructs a comprehensive reward function r_t = α_hit * ρ_hit - α_false * ρ_false + r_contrast + r_latency - α_human * human_click, where r_t represents the overall reward value, α_hit = 2 is the weight coefficient for positive samples, α_false = 1 is the weight coefficient for negative samples, α_human = 0.3 is the weight coefficient for human feedback, and human_click represents the feedback value of human intervention. The system uses the Fed-Prox regularization method for parameter updates: L_prox = L_clip + μ / 2||θ - θ_old||2, where L_prox represents the surrogate loss function, L_clip represents the base loss function, μ = 0.001 is the regularization coefficient, θ represents the current model parameters, θ_old represents the previous model parameters, and ||·||2 represents the L2 norm. This comprehensive reward mechanism achieves accurate identification and efficient processing of root cause alarms through the synergistic effect of multiple components, while the introduction of regularization terms ensures the stability of model parameter updates.

[0128] Step 50: Input the alarm information to be denoised into the target alarm model to obtain the semantic understanding result.

[0129] Specifically, to ensure the model can accurately understand the semantic content of alarm information, the system first preprocesses the alarm information to be denoised. This preprocessed information refers to the raw alarm data that needs to be filtered for redundancy and false alarms. These alarms typically originate from multiple sources, including IT systems, network devices, and security equipment. The system converts the alarm information into a standard format that the model can process. The preprocessed alarm information is then input into the target alarm model. Based on its learned alarm processing knowledge, the model performs semantic understanding of the input information. In this process, the model not only identifies the basic attributes of alarms (such as alarm type and severity) but also understands the semantic relationships between alarms. The output semantic understanding result contains a 512-dimensional feature vector, which encodes the deep semantic information of the alarms, providing a reliable feature foundation for subsequent denoising decisions.

[0130] Step 60: Optimize the semantic understanding results based on the target denoising model to obtain target alarm information.

[0131] Specifically, the system first processes the semantic understanding results using a dual-tower cross-attention structure: the semantic tower performs deep feature extraction on the semantic vectors to capture the semantic relationships between alarms; the temporal tower identifies the temporal patterns of alarm sequences by calculating the time difference Δt_i and feature difference δ_i between adjacent alarms. Then, the system uses a root cause comparison reward mechanism to evaluate the quality of the noise reduction decision. The hit rate ρ_hit of root cause events and the false alarm rate ρ_false of non-root cause events jointly influence the reward value of the decision, while also considering the penalty term r_latency caused by processing delays, comprehensively generating the final decision result. Through this decision optimization process, the system can filter out the truly important target alarm information from the original alarm information. Specifically, target alarm information includes: root cause alarms (the source alarms that cause other alarms), critical alarms (important alarms that directly affect business operations), and novel alarms (abnormal patterns appearing for the first time). The system filters out duplicate alarms (those expressing the same problem as existing alarms) and false alarms (false or worthless alarms), thereby significantly improving alarm quality and reducing the processing burden on operations personnel.

[0132] This application also provides a computer storage medium that can store multiple instructions. The instructions are adapted to be loaded and executed by a processor. The above-described alarm noise reduction method based on large model and reinforcement learning collaboration is described above. For the specific execution process, please refer to the detailed description of the above-described embodiments, which will not be repeated here.

[0133] The following describes an electronic device for alarm noise reduction based on a large model and reinforcement learning collaboration, provided by an embodiment of this application. Figure 3 This is a schematic diagram of an exemplary hardware structure of an electronic device provided in an embodiment of this application.

[0134] In some embodiments, the alarm noise reduction electronic device based on large model and reinforcement learning collaboration is a computer device or includes a computer device. The computer device includes a processor, memory, and a network interface connected via a system bus. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores data. The network interface of the computer device is used to communicate with other external terminals or servers via a network connection. In some embodiments, the network interface can be a wired network interface; in some embodiments, the network interface can also be a wireless network interface. When the computer program is executed by the processor, it implements the methods in the embodiments of this application.

[0135] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0136] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0137] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0138] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. An alarm noise reduction method based on large model and reinforcement learning collaboration, characterized in that, The method includes: Collect alarm information from the video surveillance system and classify the alarm information according to the degree of danger of each alarm information; The alarm information after classification is preprocessed to obtain alarm training data; The target alarm model is obtained by training the preset alarm base model using the alarm training data. A target noise reduction model is constructed based on the semantic understanding output of the target alarm model; The alarm information to be denoised is input into the target alarm model to obtain the semantic understanding result; Based on the target noise reduction model, the semantic understanding results are optimized to obtain target alarm information; The construction of the target denoising model includes a first stage and a second stage. The target denoising model is constructed based on the semantic understanding output of the target alarm model, including: In the first stage, a dual-tower cross-attention structure is constructed based on the semantic understanding output of the target alarm model. The dual-tower cross-attention structure includes a semantic tower for extracting deep semantics and a temporal tower for capturing temporal features. In the second stage, a root cause comparison-based reward mechanism is constructed, which is used to evaluate decision quality and guide model optimization; The dual-tower cross-attention structure is integrated with the reward mechanism to form a target noise reduction model with alarm noise reduction capability; The first stage involves constructing a dual-tower cross-attention structure based on the semantic understanding output of the target alarm model, including: The semantic understanding output of the target alarm model is used as the initial feature input to construct a semantic tower containing self-attention computing units; Temporal information is extracted from the semantic understanding output of the target alarm model to construct a temporal tower containing temporal convolutional units; The semantic features output by the semantic tower and the temporal features output by the temporal tower are concatenated after layer normalization. The spliced ​​features are subjected to dimensionality reduction to obtain fused features, and the dual-tower cross-attention structure is constructed based on the fused features.

2. The alarm noise reduction method based on large model and reinforcement learning collaboration of claim 1, characterized in that, The process of preprocessing the categorized alarm information to obtain alarm training data includes: Extract key field information from the alarm information; Perform device association analysis on the key field information to establish a device alarm association structure; Text normalization processing is performed based on the aforementioned device alarm association structure; Redundancy detection is performed using the device alarm association structure and the text after text normalization. The alarm information after redundancy detection is converted into a structured data format to form alarm training data. The structured data format retains the correlation between device alarms.

3. The alarm noise reduction method based on large model and reinforcement learning collaboration of claim 1, characterized in that, The step of training a preset alarm base model using the alarm training data to obtain a target alarm model includes: The alarm training data is converted into a prompt-response binary format; A stratified sampling strategy is used to divide the cue-response pairs into training, validation, and test sets. Construct a low-rank adaptation matrix, which is used to inject domain-preset knowledge while retaining the original knowledge of the alarm base model; The training set is used to fine-tune the parameters of the alarm base model. During the fine-tuning process, the low-rank adaptation matrix is ​​used to adjust the model weights, and the validation set is used to evaluate the intermediate results of the fine-tuning and dynamically adjust the fine-tuning parameters. The performance of the fine-tuned alarm base model is evaluated using the test set. If the performance does not meet the preset standard, the model is retrained until the performance meets the preset standard, thus obtaining the target alarm model.

4. The alarm noise reduction method based on large model and reinforcement learning collaboration according to claim 3, characterized in that, The step of adjusting the model weights using the low-rank adaptation matrix during fine-tuning includes: Determine the rank parameter of the low-rank adaptation matrix, wherein the rank parameter is less than the dimension of the original weight matrix of the alarm base model; The low-rank adaptation matrix is ​​decomposed into two factor matrices, and the decomposed factor matrices are applied to the weight matrix of each layer of the alarm base model to obtain the adjusted weight matrix. The influence of the factor matrix on the original weights is adjusted according to a preset scaling factor. The model forward calculation is performed based on the adjusted weight matrix, while the original weights of the alarm base model are frozen. The factor matrix is ​​updated using gradients based on the forward computation results, and preset parameters such as training batch size, gradient accumulation steps, and learning rate are applied during the gradient update process.

5. The alarm noise reduction method based on large model and reinforcement learning collaboration of claim 1, characterized in that, The second stage of constructing a reward mechanism based on root cause comparison includes: In the alarm information, the set of alarms marked as root cause events is defined as positive samples, and the remaining set of non-root cause alarms is defined as negative samples. A root cause comparison reward item is constructed, which is obtained by calculating the logarithm of the ratio of positive samples to negative samples. A latency-based penalty term is determined, which increases as the alarm processing latency increases; By combining the root cause comparison reward and the penalty, an overall reward function is constructed, and the parameter update of the dual-tower cross-attention structure is guided by the overall reward function.

6. An electronic device for alarm noise reduction based on large model and reinforcement learning collaboration, characterized in that, The electronic device includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code including computer instructions, and the one or more processors call the computer instructions to cause the electronic device to perform the method as described in any one of claims 1-5.

7. A computer program product comprising instructions, characterized in that, When the computer program product is run on an electronic device for alarm noise reduction based on a large model and reinforcement learning collaboration, the electronic device performs the method as described in any one of claims 1-5.

8. A computer-readable storage medium comprising instructions, characterized in that, When the instructions are executed on an electronic device for alarm noise reduction based on a large model and reinforcement learning collaboration, the electronic device causes the electronic device to perform the method as described in any one of claims 1-5.

Citation Information

Patent Citations

  • Intrusion detection alarm noise reduction and priority dynamic sorting method

    CN120880869A