Operation and maintenance alarm intelligent filtering and grading processing method based on adaptive algorithm

Abstract

The invention provides an operation and maintenance alarm intelligent filtering and grading processing method based on a self-adaptive algorithm, and relates to the technical field of computer operation and maintenance management, and the method comprises the steps: obtaining an alarm event, extracting semantic and time sequence characteristics, carrying out the dynamic clustering through employing a self-adaptive similarity measurement mechanism, calculating a priority score based on an influence range and an emergency degree, and carrying out the calculation of an alarm result. And a self-adaptive filtering strategy is implemented in combination with the operation and maintenance resource state, and finally, filtered alarms are distributed to corresponding operation and maintenance units for processing, collection and feedback. According to the method, redundant alarms can be effectively reduced, resource allocation is optimized, and the operation and maintenance efficiency and the alarm processing accuracy are improved.

Description

Technical Field

[0001] This invention relates to the field of computer operation and maintenance management technology, and in particular to a method for intelligent filtering and hierarchical processing of operation and maintenance alarms based on adaptive algorithms. Background Technology

[0002] In modern IT operations and maintenance environments, system complexity is constantly increasing, and the number of alarms generated by various monitoring systems is exploding. Operational alarm management has become a critical aspect of ensuring system stability and service availability. Traditional alarm handling methods typically rely on fixed rules and manual intervention, but these methods face significant challenges as systems scale and business complexity increase. Effective alarm filtering and hierarchical processing mechanisms are crucial for improving operational efficiency, reducing system risks, and optimizing resource allocation. Summary of the Invention

[0003] This invention provides a method for intelligent filtering and hierarchical processing of operation and maintenance alarms based on adaptive algorithms, which can solve the problems in the prior art.

[0004] A first aspect of this invention provides a method for intelligent filtering and hierarchical processing of operation and maintenance alarms based on an adaptive algorithm, comprising: Acquire alarm events to be processed, perform semantic parsing and temporal pattern recognition on each alarm event to be processed, extract its semantic feature vector and temporal correlation features, and obtain alarm features; Based on the alarm features, the alarm events to be processed are dynamically clustered through an adaptive similarity measurement mechanism to obtain multiple alarm event clusters; Based on the forward causal propagation subgraph and backward causal tracing subgraph of each alarm event cluster, and combined with the processing data of historical alarm event clusters, the scope of impact and urgency are calculated to determine the priority score of each alarm event cluster. Based on the priority score of each alarm event cluster, combined with the availability status of operation and maintenance resources and the alarm processing capacity threshold, an adaptive filtering strategy is used to filter alarm event clusters, retaining alarm event clusters that need to be processed immediately and suppressing alarm event clusters that can be delayed or are redundant, thus obtaining the filtered alarm event clusters. By using a preset operation and maintenance responsibility mapping relationship, the filtered alarm event clusters are distributed to the corresponding operation and maintenance processing units for processing, and the actual processing results and processing time data are collected as feedback information output.

[0005] Semantic parsing and temporal pattern recognition are performed on each pending alarm event to extract its semantic feature vector and temporal correlation features, resulting in alarm features, including: Semantic parsing is performed on the description information of each alarm event to be processed. The entity objects, attribute types and status descriptions of the alarm events to be processed are extracted through lexical analysis and syntactic analysis. Semantic mapping is performed on them based on a pre-built operation and maintenance semantic knowledge base to obtain the semantic feature vector of each alarm event to be processed. The time sequence pattern recognition is performed on the alarm events to be processed. By analyzing the occurrence timestamps and durations of each alarm event to be processed, a time sequence correlation matrix is ​​constructed. Based on the time sequence correlation matrix, the temporal sequence relationship and time sequence periodicity pattern between each alarm event to be processed are identified. The time sequence periodicity pattern represents the recurrence pattern of alarm events in the time dimension. Based on the semantic feature vector, the temporal sequence relationship, and the temporal periodicity pattern, semantic and temporal joint encoding is performed on each alarm event to be processed to obtain the alarm features of each alarm event to be processed.

[0006] Based on the alarm features, the alarm events to be processed are dynamically clustered using an adaptive similarity measurement mechanism to obtain multiple alarm event clusters, including: The system is divided into multiple time-series stages. Based on the alarm features, the distribution density value of the alarm events to be processed in each time-series stage is calculated. Based on the semantic feature vector of the alarm events to be processed, a semantic distribution map is constructed in the semantic space. The local semantic density value and global semantic outlier value of each alarm event to be processed in the semantic distribution map are calculated. A multi-level similarity calculation model is constructed. For alarm events to be processed in the same time series, the similarity is calculated based on the local semantic density value and weights are assigned. For alarm events in different time series, the similarity is calculated based on the global semantic outlier value and the distribution density value and weights are assigned. Based on the multi-level similarity calculation model, the comprehensive similarity value between each alarm event to be processed is calculated, and clustering is performed according to the comprehensive similarity value. Alarm events to be processed that meet the clustering conditions are divided into the same alarm event cluster, resulting in multiple alarm event clusters.

[0007] Based on the forward causal propagation subgraph and backward causal tracing subgraph of each alarm event cluster, and combined with the processing data of historical alarm event clusters, the scope of impact and urgency are calculated to determine the priority score of each alarm event cluster, including: Based on the pre-constructed alarm event graph, extract the causal outgoing edge set and causal incoming edge set of each alarm event cluster, and construct the forward causal propagation subgraph and the backward causal tracing subgraph of each alarm event cluster. Based on the aforementioned forward causal propagation subgraph, propagation path simulation is performed to predict the triggering time window and triggering probability of downstream alarm events in each propagation path, and the total number of system component nodes, business process nodes and data flow nodes involved are counted to calculate the impact range value of each alarm event cluster. Based on the backward causal tracing subgraph, the structural similarity between each alarm event cluster and the historical alarm event cluster is calculated. Historical alarm event clusters with structural similarity greater than the similarity threshold are selected, their historical processing data is obtained, a historical processing effect evaluation model is constructed, and the system recovery status of each alarm event cluster under different processing time conditions and the probability of occurrence of derived alarm events are predicted to obtain the processing urgency of each alarm event cluster. Based on the impact range value and the processing urgency, calculate the priority score for each alarm event cluster.

[0008] Based on the priority scores of each alarm event cluster, combined with the availability of operational resources and alarm processing capacity thresholds, an adaptive filtering strategy is used to filter alarm event clusters, retaining those requiring immediate processing and suppressing those that can be delayed or are redundant. The resulting filtered alarm event clusters include: Obtain the current availability status information of operation and maintenance resources, and calculate the alarm processing capacity threshold at the current moment by combining the average processing time and average resource consumption of historical alarm event clusters. Construct the component dependency propagation tree for each alarm event cluster, and calculate the tree edit distance and root node consistency between any two component dependency propagation trees. If the tree edit distance is less than the tree structure difference threshold and the root node consistency is true, then mark the corresponding alarm event cluster as a structurally redundant cluster pair. Alarm event clusters with low priority scores in the structural redundancy cluster pair are marked as redundant alarm event clusters and removed, while alarm event clusters with high priority scores in the structural redundancy cluster pair are retained, resulting in the redundancy-removed alarm event clusters. Based on the priority score, the alarm event clusters after removing redundancy are sorted in descending order. Alarm event clusters are selected sequentially from the sorting results until the alarm processing capacity threshold is reached. These clusters are then marked as emergency alarm event clusters, and the remaining alarm event clusters are marked as alarm event clusters that can be delayed, thus obtaining the filtered alarm event clusters.

[0009] Construct the component dependency propagation tree for each alarm event cluster, and calculate the tree edit distance and root node consistency between any two component dependency propagation trees. If the tree edit distance is less than the tree structure difference threshold and the root node consistency is true, then mark the corresponding alarm event cluster as a structurally redundant cluster pair, including: For each alarm event cluster, extract the system component nodes involved, construct a component dependency propagation tree based on the occurrence time of the corresponding alarm event, take the system component node corresponding to the root alarm event as the root node, and the system component node corresponding to the derived alarm event as the child node, and describe the abnormal propagation dependency relationship between system component nodes through directed edges. Perform tree structure matching analysis on the component dependency propagation trees of any two alarm event clusters, transform the component dependency propagation tree of the first alarm event cluster into the component dependency propagation tree of the second alarm event cluster, calculate the number of node insertion operations, node deletion operations and node replacement operations to be performed, and obtain the tree edit distance. Determine whether the system component nodes corresponding to the root nodes of the dependency propagation trees of two components are the same system component node to obtain root node consistency. If the tree edit distance is less than the tree structure difference threshold and the root node consistency is true, then mark the corresponding alarm event cluster as a structural redundancy cluster pair.

[0010] Based on a pre-defined operation and maintenance responsibility mapping relationship, the filtered alarm event clusters are distributed to the corresponding operation and maintenance processing units for processing, and the actual processing results and processing timeliness data are collected as feedback information output, including: Based on the resource ownership information and service type identifier of the filtered alarm event clusters, the target operation and maintenance processing unit corresponding to each alarm event cluster is determined through the preset operation and maintenance responsibility mapping relationship, and then distributed to the target operation and maintenance processing unit. In the target operation and maintenance processing unit, based on the fault feature information in the filtered alarm event cluster, fault location and repair operations are performed to generate actual processing results containing fault root cause identification and repair measure records; the time interval from the distribution time of the filtered alarm event cluster to the processing completion time is calculated to obtain processing timeliness data; The actual processing result is associated with and encapsulated with the processing time data to form feedback information, which is then output to the terminal device.

[0011] A second aspect of this invention provides an intelligent filtering and hierarchical processing system for operation and maintenance alarms based on an adaptive algorithm, comprising: The first unit is used to acquire alarm events to be processed, perform semantic parsing and temporal pattern recognition on each alarm event to be processed, extract its semantic feature vector and temporal correlation features, and obtain alarm features. The second unit is used to dynamically cluster the alarm events to be processed based on the alarm features through an adaptive similarity measurement mechanism to obtain multiple alarm event clusters. The third unit is used to calculate the scope of impact and urgency of each alarm event cluster based on the forward causal propagation subgraph and the backward causal tracing subgraph of each alarm event cluster, combined with the processing data of historical alarm event clusters, and to determine the priority score of each alarm event cluster. The fourth unit is used to filter alarm event clusters based on the priority score of each alarm event cluster, combined with the availability status of operation and maintenance resources and alarm processing capacity thresholds, through an adaptive filtering strategy. It retains alarm event clusters that need to be processed immediately and suppresses alarm event clusters that can be delayed or are redundant, thus obtaining the filtered alarm event clusters. The fifth unit is used to distribute the filtered alarm event clusters to the corresponding operation and maintenance processing units for processing through a preset operation and maintenance responsibility mapping relationship, and to collect the actual processing results and processing time data as feedback information output.

[0012] A third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0013] Fourth aspect of the present invention, A computer-readable storage medium is provided, having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0014] The beneficial effects of this application are as follows: The intelligent filtering and hierarchical processing method for operation and maintenance alarms based on adaptive algorithms provided by this invention accurately extracts alarm features through semantic parsing and temporal pattern recognition technology, realizes intelligent clustering and priority evaluation of alarm events, effectively reduces the number of invalid alarms faced by operation and maintenance personnel, and improves alarm processing efficiency.

[0015] This method employs an adaptive similarity measurement mechanism and a dynamic clustering algorithm, which can automatically adjust the clustering strategy according to changes in alarm features and implement intelligent filtering in conjunction with the availability status of operation and maintenance resources. This solves the problem of poor adaptability of traditional fixed rule filtering methods and significantly improves the system's ability to handle alarm events in complex and ever-changing network environments.

[0016] By establishing a mapping relationship between operation and maintenance responsibilities and a feedback mechanism, this method achieves accurate distribution and continuous optimization of alarm events, enabling reasonable allocation of operation and maintenance resources, reducing system maintenance costs, and continuously optimizing the alarm handling strategy through feedback learning of processing results, thereby improving the overall intelligence level and reliability of the operation and maintenance system. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the intelligent filtering and hierarchical processing method for operation and maintenance alarms based on adaptive algorithms, as described in an embodiment of the present invention. Figure 2 This is a schematic diagram of the system architecture for calculating the priority score of alarm event clusters. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0020] Figure 1 This is a flowchart illustrating the intelligent filtering and hierarchical processing method for operation and maintenance alarms based on adaptive algorithms, as described in an embodiment of the present invention. Figure 1 As shown, the method includes: Acquire alarm events to be processed, perform semantic parsing and temporal pattern recognition on each alarm event to be processed, extract its semantic feature vector and temporal correlation features, and obtain alarm features; Based on the alarm features, the alarm events to be processed are dynamically clustered through an adaptive similarity measurement mechanism to obtain multiple alarm event clusters; Based on the forward causal propagation subgraph and backward causal tracing subgraph of each alarm event cluster, and combined with the processing data of historical alarm event clusters, the scope of impact and urgency are calculated to determine the priority score of each alarm event cluster. Based on the priority score of each alarm event cluster, combined with the availability status of operation and maintenance resources and the alarm processing capacity threshold, an adaptive filtering strategy is used to filter alarm event clusters, retaining alarm event clusters that need to be processed immediately and suppressing alarm event clusters that can be delayed or are redundant, thus obtaining the filtered alarm event clusters. By using a preset operation and maintenance responsibility mapping relationship, the filtered alarm event clusters are distributed to the corresponding operation and maintenance processing units for processing, and the actual processing results and processing time data are collected as feedback information output.

[0021] In one optional implementation, semantic parsing and temporal pattern recognition are performed on each alarm event to be processed, and its semantic feature vector and temporal correlation features are extracted to obtain alarm features, including: Semantic parsing is performed on the description information of each alarm event to be processed. The entity objects, attribute types and status descriptions of the alarm events to be processed are extracted through lexical analysis and syntactic analysis. Semantic mapping is performed on them based on a pre-built operation and maintenance semantic knowledge base to obtain the semantic feature vector of each alarm event to be processed. The time sequence pattern recognition is performed on the alarm events to be processed. By analyzing the occurrence timestamps and durations of each alarm event to be processed, a time sequence correlation matrix is ​​constructed. Based on the time sequence correlation matrix, the temporal sequence relationship and time sequence periodicity pattern between each alarm event to be processed are identified. The time sequence periodicity pattern represents the recurrence pattern of alarm events in the time dimension. Based on the semantic feature vector, the temporal sequence relationship, and the temporal periodicity pattern, semantic and temporal joint encoding is performed on each alarm event to be processed to obtain the alarm features of each alarm event to be processed.

[0022] During the semantic parsing of alarm events, the system receives descriptive information for various alarm events to be processed, such as "the temperature in area A of the data center has abnormally increased to 28°C for 15 minutes." For such alarm information, the text content is segmented by a lexical analyzer, breaking it down into basic language units. Keyword groups such as "data center," "area A," "temperature," "abnormally increased," "28°C," "continuous," and "15 minutes" are identified. A syntax tree is constructed using a syntactic analyzer to determine the modification and subordination relationships between each phrase, clarifying that "area A of the data center" is an entity object, "temperature" is an attribute type, and "abnormally increased to 28°C" is a status description.

[0023] In the semantic mapping stage, a pre-built operation and maintenance semantic knowledge base is invoked. This knowledge base is constructed using layered ontology modeling technology and includes multiple abstract layers such as concept definition layer, relation constraint layer, and instance data layer. The concept definition layer of the knowledge base contains more than 6,000 standard concepts in the operation and maintenance field. Each concept contains detailed information such as a unique identifier, standard name, synonym set, attribute definition, and inheritance relationship. The physical area entity class definition includes standard attributes such as geographical location, capacity scale, environmental parameters, and management permissions, providing a unified semantic framework for entity mapping. The environmental monitoring indicator class definition includes technical specifications such as measurement range, accuracy requirements, alarm threshold, and sampling frequency, ensuring the accuracy and consistency of attribute mapping.

[0024] The semantic mapping process precisely associates the extracted entities, attributes, and state information with standard concepts in the knowledge base. For the entity "Data Center A Area," the knowledge base searches for related concepts of physical areas. Through lexical matching and semantic analysis, it is mapped to the physical area entity class with the identifier "0101." The attribute "Temperature" is mapped to the environmental monitoring indicator class with the identifier "2003" through attribute classification dictionary lookup and semantic role analysis. The state "Abnormally High" is mapped to the abnormal state class with the identifier "3056" after state classification and degree analysis.

[0025] The semantic feature vector generation process encodes the mapped semantic information into a unified numerical vector representation. The vector space adopts a 128-dimensional dense representation method, which is assigned to different semantic dimensions such as entity type, attribute category, state feature, numerical information, time feature, and relational information. The entity identification dimension encodes "0101" into the 1st to 20th dimensions of the vector. Through binary expansion and normalization, the corresponding numerical sequence is generated. The attribute type dimension encodes "2003" into the 21st to 40th dimensions. The state description dimension encodes "3056" into the 41st to 60th dimensions. The numerical information dimension encodes the temperature value and unit information of "28℃". The time feature dimension encodes the duration information of "15 minutes". The generated 128-dimensional semantic feature vector adopts a sparse coding strategy. Only the dimensions related to the current alarm event are activated and set with corresponding values. Irrelevant dimensions remain at zero values ​​to ensure the efficiency of vector representation and the accuracy of semantic expression.

[0026] In the temporal pattern recognition stage, the timestamps and durations of each alarm event are analyzed. Taking alarm data from a data center over a week as an example, multiple types of alarms were collected, including "server CPU utilization exceeding the threshold," "abnormal network latency," and "abnormal temperature." Each alarm is recorded with a precise timestamp and duration, constructing an N×N temporal correlation matrix M (where N is the number of alarm events). Each element m in the matrix... ij This represents the time interval between alarm event i and alarm event j. For example, if the "Server CPU utilization exceeds threshold" alarm (event 1) occurs at 08:15:30 on 2023-06-01, and the "Network latency anomaly" alarm (event 2) occurs at 08:17:45 on 2023-06-01, then m 12 The value is 135 seconds.

[0027] Based on the temporal correlation matrix, the temporal sequence relationship between alarm events is identified. By analyzing the positive and negative values ​​in the matrix, the chronological order of events is determined, and a causal relationship graph is constructed. The causal relationship graph is constructed based on the temporal correlation matrix M, where matrix elements m ij This represents the time interval (in seconds) between alarm event i and alarm event j, when m ijWhen m > 0, it indicates that event i occurred before event j; when m ij When m < 0, it indicates that event i occurs after event j; when m ij When the value is 0, it indicates that the two events occur simultaneously, and a time window threshold T is set. threshold (The default value is 300 seconds, which can be adjusted according to system characteristics). When 0 < m ij ≤T threshold When event i is determined to be a candidate cause of event j, it is considered to be event i.

[0028] causal relationship strength S ij By statistically analyzing historical data, we can find that after event i occurs, event j occurs within a time window T. threshold The conditional probability P(j|i) of the event occurring within the time frame is calculated, i.e., S ij = P(j|i), when S ij ≥ S threshold Time (S) threshold S is the threshold for causal association strength (usually set to 0.6). A directed edge is established from node i to node j in the causal association graph, with edge weight S. ij The resulting causal graph G=(V,E) is obtained, where V is the set of alarm event nodes and E is the set of causal relationship edges. Each node contains attributes: event type, occurrence frequency, and average duration; each edge contains the attribute: causal strength S. ij Average time delay m ij .

[0029] By analyzing the alarm data within a week, it was found that the number of times "Network latency anomaly" (Event 2) occurred within 300 seconds after "Server CPU utilization exceeds threshold" (Event 1) was 8. Event 1 occurred a total of 10 times. Therefore, the conditional probability P(2|1) = 8 / 10 = 0.8 > 0.6. Thus, a directed edge from Event 1 to Event 2 was established in the causal relationship graph with an edge weight of 0.8.

[0030] Further analysis of the temporal periodicity of alarm events, through Fourier transform analysis of the alarm time series, revealed that the "temperature anomaly" alarm has obvious periodicity characteristics in the period from 14:00 to 16:00 every day, which coincides with the peak business load period of the data center every day. This periodicity characteristic was recorded as "daily cycle, afternoon peak period, lasting about 120 minutes".

[0031] In the semantic-temporal joint coding stage, the semantic feature vector and temporal features are fused together. Taking the temperature anomaly alarm as an example, its semantic feature vector is a 128-dimensional vector. The temporal sequence is represented as "10 minutes after the power load alarm and 5 minutes before the cooling system alarm". The temporal periodicity pattern is "daily cycle, afternoon peak period, lasting about 120 minutes". The semantic feature vector has been obtained through semantic parsing and knowledge base mapping, and includes entity type encoding (20 dimensions), attribute category encoding (20 dimensions), state feature encoding (20 dimensions), numerical information encoding (20 dimensions), and relational information encoding (48 dimensions).

[0032] The temporal sequence is encoded into a 64-dimensional feature vector. The preceding event encoding (32-dimensional) records the identifier and time interval of the direct cause event of the current alarm, and the subsequent event encoding (32-dimensional) records the identifier and expected time delay of the direct result event caused by the current alarm. An embedding layer is used to map discrete event IDs into continuous vectors, and the time interval is encoded after logarithmic normalization.

[0033] The time-series periodic feature vector is encoded as a 64-dimensional feature vector. Among them, the period type encoding (16-dimensional) is a one-hot encoding of daily, weekly, and monthly periods, the peak period encoding (16-dimensional) is a distributed representation of the peak period, the duration encoding (16-dimensional) is the average duration of the periodic event, and piecewise function encoding is used. The repetition frequency encoding (16-dimensional) is the frequency of occurrence per unit time, and logarithmic scale encoding is used.

[0034] The three types of feature vectors with different dimensions are projected onto a unified 256-dimensional feature space. An attention mechanism is used to calculate the importance weight of each feature and fuse them. For the example of the above temperature anomaly alarm, the attention scores are calculated to be 0.6, 0.25 and 0.15, respectively. The attention scores are used as the importance weights of the feature vectors for feature fusion.

[0035] In practical applications, 5,000 alarm events generated by a cloud computing platform within a month were processed. Through semantic parsing, these alarms were classified into 15 semantic categories, including equipment failure, performance anomalies, and security threats. Through temporal pattern recognition, 37 alarm patterns with obvious temporal correlations were discovered, including 23 causal correlation patterns and 14 periodic patterns. These identified alarm features provided effective input for subsequent root cause analysis and intelligent operation and maintenance, helping operation and maintenance personnel reduce the average fault handling time from 45 minutes to 28 minutes, thereby improving system reliability and service quality.

[0036] In one optional implementation, based on the alarm features, the alarm events to be processed are dynamically clustered using an adaptive similarity measurement mechanism to obtain multiple alarm event clusters, including: The system is divided into multiple time-series stages. Based on the alarm features, the distribution density value of the alarm events to be processed in each time-series stage is calculated. Based on the semantic feature vector of the alarm events to be processed, a semantic distribution map is constructed in the semantic space. The local semantic density value and global semantic outlier value of each alarm event to be processed in the semantic distribution map are calculated. A multi-level similarity calculation model is constructed. For alarm events to be processed in the same time series, the similarity is calculated based on the local semantic density value and weights are assigned. For alarm events in different time series, the similarity is calculated based on the global semantic outlier value and the distribution density value and weights are assigned. Based on the multi-level similarity calculation model, the comprehensive similarity value between each alarm event to be processed is calculated, and clustering is performed according to the comprehensive similarity value. Alarm events to be processed that meet the clustering conditions are divided into the same alarm event cluster, resulting in multiple alarm event clusters.

[0037] In this specific embodiment, the alarm characteristics of each alarm event to be processed are obtained, and the time sequence is divided into time stages. A fixed time window or an adaptive time window method can be used. Taking the fixed time window as an example, 24 hours are divided into 48 time sequence stages, each stage is 30 minutes. For the adaptive time window, the window size is dynamically adjusted according to the alarm event density. During high density periods, the window becomes smaller (e.g., 15 minutes), and during low density periods, the window becomes larger (e.g., 60 minutes).

[0038] To calculate the alarm event distribution density value within each time period, the ratio of the number of alarms in that period to the length of the time interval can be calculated. For example, if there are 45 alarm events in a 30-minute period, the distribution density value is 1.5 events / minute. To enhance the accuracy of the density representation, alarm severity weights can be introduced, assigning higher weights to higher-level alarms. For example, the weight of an emergency alarm is 2, the weight of a warning alarm is 1, and the weight of a notification alarm is 0.5.

[0039] During the construction of the semantic distribution map, the semantic distance between any two alarm events is calculated using the Euclidean distance metric. Taking alarm event E1 "server host memory utilization reaches 85%" and alarm event E2 "storage device disk space utilization exceeds 90%" as examples, their semantic feature vectors are V1 and V2, respectively. The semantic distance is obtained by summing the squared differences of each dimension and then taking the square root. When the value of V1 in the entity dimension is 0.72 and V2 is 0.68, the squared difference of this dimension is 0.0016. The squared differences of all 128 dimensions are calculated sequentially, and the sum is obtained to obtain a total value of 12.34. After taking the square root, the semantic distance value of 3.51 is obtained. The corresponding semantic distance value is calculated for each pair of alarm events in the dataset to construct a complete distance matrix.

[0040] The neighborhood definition module determines the local neighborhood range of each alarm event in the semantic space. An adjustable neighborhood radius parameter r is set, with a default value of 2.8, meaning that all events with a semantic distance of less than or equal to 2.8 from the target event constitute its neighborhood set. For alarm event E3 "abnormal increase in network switch port traffic", all other alarm events are traversed, the semantic distance between E3 and each event is calculated, and events with a distance value of less than or equal to 2.8 are selected to form neighborhood set N3. Assuming that neighborhood set N3 contains 15 alarm events, including network-related alarm events such as "high router interface bandwidth usage", "surge in firewall connection count", and "load balancer response delay", the neighborhood radius parameter can be dynamically adjusted according to the distribution characteristics of the dataset and application requirements. Smaller radius values ​​produce denser neighborhoods, while larger radius values ​​produce more relaxed neighborhood ranges.

[0041] The local semantic density calculation module quantifies the degree of semantic clustering around each alarm event and counts the number of alarm events contained in the neighborhood of the target event as the basic data for density calculation. With a neighborhood radius of 2.8, the neighborhood set of alarm event E3 contains 15 events, so its neighborhood event count is 15. The density value is calculated by dividing the neighborhood event count by the neighborhood volume, where the neighborhood volume is obtained by multiplying the cube of the radius value by the sphere volume constant. When the neighborhood radius is 2.8, the corresponding neighborhood volume is 91.95. The local semantic density value of E3 is equal to the neighborhood event count of 15 divided by the neighborhood volume of 91.95, resulting in a density value of 0.163. A high density value indicates that there are a large number of semantically similar events around the alarm event, which usually corresponds to common alarm types or associated fault modes.

[0042] The global semantic outlier calculation module evaluates the degree of anomalousness of each alarm event relative to the overall data distribution. It employs a density-based outlier detection algorithm, quantifying the outlier degree by comparing the local density of the target event with the average density of its neighboring events. For alarm event E4 "Database connection pool abnormally disconnected all connections," the local density values ​​of all events within its neighborhood are calculated, including E4's own density value of 0.089 and the density values ​​of its eight neighboring events (0.156, 0.134, 0.178, 0.145, 0.167, 0.123, 0.189, and 0.142 respectively). The average density value of all nine neighboring events is calculated, with a total of 1.423 and an average value of 0.158.

[0043] The global semantic outlier value is measured by the ratio of the target event density to the average density of its neighborhood. The outlier value of E4 is equal to the average density of its neighborhood (0.158) divided by its own density (0.089), resulting in an outlier value of 1.775. An outlier value greater than 1 indicates that the density of the target event is lower than the average level of its neighborhood. The larger the value, the more significant the outlier. When the outlier value is close to 1, it indicates that the target event and its neighborhood have a similar density distribution, which is a normal aggregation pattern. The outlier threshold is set to 1.5. Alarm events exceeding this threshold are identified as potential outlier events, representing rare failure modes or abnormal system behavior.

[0044] The multi-scale analysis module repeatedly performs density and outlier calculations using different neighborhood radius parameters to obtain multi-level semantic distribution features. Three neighborhood radius values ​​are configured: 2.0, 2.8, and 3.6, corresponding to three analysis scales: tight neighborhood, standard neighborhood, and loose neighborhood, respectively. For the same alarm event, different density and outlier characteristics are observed under different radius settings. The local density of alarm event E5 "Virtual Machine Manager Resource Scheduling Abnormality" is 0.245 and the outlier is 0.892 at a radius of 2.0; 0.198 and 1.156 at a radius of 2.8; and 0.167 and 1.234 at a radius of 3.6. The multi-scale analysis results reveal that this event behaves normally in the tight neighborhood but exhibits slight outlier characteristics in a larger semantic space.

[0045] Anomaly detection thresholds are set based on the statistical distribution characteristics of the dataset and the specific requirements of the application scenario. By analyzing the outlier distribution of all alarm events, the threshold boundaries for anomaly detection are determined using the quantile method. When 95% of the alarm events have outlier values ​​in the range of 0.3 to 2.1, an outlier value of 2.1 exceeding the 95th quantile is set as a strong outlier threshold, and an outlier value of 1.8 exceeding the 90th quantile is set as a weak outlier threshold. Alarm events with outlier values ​​exceeding 2.1 are identified as strong outlier events, which usually correspond to serious system failures or unknown anomaly patterns. Events with outlier values ​​between 1.8 and 2.1 are identified as weak outlier events, representing alarm types that are uncommon but still within the normal range.

[0046] When constructing a multi-level similarity calculation model, the handling strategies for alarm events in the same time series and those in different time series are distinguished. For alarm events within the same time series, the similarity calculation formula is: a weighted combination of basic semantic similarity and local semantic density value. For example, if the basic semantic similarity between alarms A and B is 0.8, and the local semantic density value of A is 10, with a weight of 0.7, then the final similarity is 0.8 × 0.7 + 0.3 × (10 / maximum local semantic density value). Semantic similarity is the primary criterion, with a weight of 0.7. The density factor is used to adjust the cluster density, with a weight of 0.3. Alarm events within the same time series have temporal proximity, so semantic similarity is the primary focus. The density factor is used to identify core alarm clusters; alarms in high-density areas are more likely to belong to the same fault mode.

[0047] For alarm events at different time stages, the similarity calculation formula is: a weighted combination of basic semantic similarity, global semantic outlier value, and distribution density value. For example, alarms C and D located in different time periods have a basic semantic similarity of 0.75, a global semantic outlier value of 1.2 for C, and a distribution density value of 1.8 for D's time period, with weights of 0.6, 0.2, and 0.2 respectively. Therefore, the final similarity is 0.75 × 0.6 + 0.2 × (1 - 1.2 / maximum outlier value) + 0.2 × (1.8 / maximum distribution density value). Alarms at different time stages lack temporal proximity and require comprehensive judgment through multi-dimensional features. The outlier factor is used to identify rare but relevant fault modes, while the density comparison factor is used to associate periodic or load-related alarm modes. The weights can be adaptively adjusted according to the characteristics of the dataset.

[0048] After calculating the overall similarity value between each alarm event to be processed, a clustering algorithm is used to group them. Density-based clustering algorithms such as DBSCAN or hierarchical clustering algorithms can be used. Taking DBSCAN as an example, the similarity threshold is set to 0.75 and the minimum number of points is 3. When the overall similarity between alarm events is greater than 0.75 and the number of points in the neighborhood is not less than 3, they are divided into the same alarm event cluster.

[0049] Through the above steps, multiple alarm event clusters are obtained. The alarm events in each cluster have high similarity and represent the same or related system problems. For example, multiple "connection interruption" alarms generated by the same network device in a short period of time will be aggregated into one event cluster, while alarms generated by different devices for different reasons will be divided into different clusters.

[0050] The advantage of this method is that it can adaptively process time-series alarm data, take into account the spatiotemporal distribution characteristics of alarm events, improve clustering accuracy through multi-level similarity calculation, effectively reduce the number of alarms that maintenance personnel need to handle, and improve the efficiency of problem localization.

[0051] Figure 2 This is a schematic diagram of the system architecture for calculating the priority score of alarm event clusters. In one optional implementation, based on the forward causal propagation subgraph and the backward causal tracing subgraph of each alarm event cluster, and combined with the processing data of historical alarm event clusters, the scope of influence and urgency are calculated to determine the priority score of each alarm event cluster, including: Based on the pre-constructed alarm event graph, extract the causal outgoing edge set and causal incoming edge set of each alarm event cluster, and construct the forward causal propagation subgraph and the backward causal tracing subgraph of each alarm event cluster. Based on the aforementioned forward causal propagation subgraph, propagation path simulation is performed to predict the triggering time window and triggering probability of downstream alarm events in each propagation path, and the total number of system component nodes, business process nodes and data flow nodes involved are counted to calculate the impact range value of each alarm event cluster. Based on the backward causal tracing subgraph, the structural similarity between each alarm event cluster and the historical alarm event cluster is calculated. Historical alarm event clusters with structural similarity greater than the similarity threshold are selected, their historical processing data is obtained, a historical processing effect evaluation model is constructed, and the system recovery status of each alarm event cluster under different processing time conditions and the probability of occurrence of derived alarm events are predicted to obtain the processing urgency of each alarm event cluster. Based on the impact range value and the processing urgency, calculate the priority score for each alarm event cluster.

[0052] In this embodiment, multiple alarm event clusters need to be received, and causal relationship information needs to be extracted from a pre-built alarm event graph. This graph uses a directed graph structure to represent the temporal dependencies and causal propagation relationships between alarm events. The graph contains a set of nodes and a set of edges. Each node represents a specific type of alarm event, and the edges represent the causal relationships between events and their strength weights. For alarm event cluster C1, which contains three related events: "storage array controller failure", "increased disk read / write latency", and "data backup task failure", the graph structure is traversed, and all directed edges originating from node C1 are identified as the causal outgoing edge set. The outgoing edge set contains causal relationships pointing to downstream events such as "database query timeout", "slow application service response", and "file system access anomaly". Each edge carries a causal strength weight value. For example, the weight from C1 to "database query timeout" is 0.78, indicating a strong causal relationship.

[0053] During the extraction of the causal incoming edge set, all incoming edges pointing to the target alarm event cluster are identified, representing the upstream causes that led to the occurrence of the event cluster. The causal incoming edge set of alarm event cluster C1 contains causal relationship edges from upstream events such as "unstable power supply", "abnormal heat dissipation system", and "hardware aging detection alarm". The weight information and time delay parameters of each incoming edge are recorded. For example, the causal weight of "unstable power supply" to C1 is 0.65, and the average time delay is 8 minutes, indicating that power problems usually cause storage system failures after 8 minutes. The integrity of the incoming edge set is guaranteed by a graph traversal algorithm, and a depth-first search strategy is used to ensure that no potential causal relationship paths are missed.

[0054] The forward causal propagation subgraph is constructed starting with the target alarm event cluster. A complete influence propagation network is built by recursively traversing the causal outgoing edges. For event cluster C1, starting from its direct downstream events, the causal outgoing edges of these events are extracted to form a multi-level propagation path network. The depth parameter of the propagation subgraph is set to 5 layers, which represents the influence range of the system tracking 5 levels of propagation relationships. The first layer contains 6 events that directly affect C1, such as "database query timeout" and "slow application service response". The second layer contains 12 events that are further affected by these 6 events, such as "user login failure" and "transaction processing interruption". The propagation subgraph adopts a weighted directed graph structure, retaining the weight information and time delay parameters in the original graph to ensure the accuracy of the propagation simulation.

[0055] The backward causal tracing subgraph construction process starts with the target event cluster as the endpoint and traces all causal paths upward. Starting from the causal incoming edge of C1, it recursively extracts the incoming edge relationships of upstream events to construct a multi-level tracing network. The tracing depth is also set to 5 layers. The first layer contains 3 direct causes such as "unstable power supply" and "abnormal heat dissipation system". The second layer contains 7 upstream events of these causes, such as "UPS battery aging" and "abnormal data center environment monitoring". The tracing subgraph records the cumulative causal strength and overall time span of each path, providing basic data for subsequent similarity analysis and processing strategy matching.

[0056] Dynamic simulation calculations are performed based on the forward causal propagation subgraph to predict the triggering time and probability of downstream alarm events. The simulation algorithm adopts a discrete event simulation method, dividing the time into 1-minute simulation steps. In each time step, the event state update is calculated. For the propagation path triggered by C1, the initial triggering time is set to T0. The expected triggering time of downstream events is calculated by accumulating the time delay parameters along the path. The expected triggering time for "database query timeout" is T0 plus a 12-minute propagation delay, and the triggering time for "user login failure" is T0 plus 18 minutes. The triggering probability is calculated by multiplying all causal weights along the path. The triggering probability of the path from C1 to "user login failure" is 0.78 multiplied by 0.83, which equals 0.647.

[0057] The time window prediction takes into account the uncertainty and random fluctuations of event triggering. A confidence interval for the triggering time is calculated for each downstream event. Based on historical data statistical analysis, the standard deviation parameter of the time delay is determined. For a propagation path with an average delay of 12 minutes, the standard deviation is set to 3 minutes. The triggering time window for "database query timeout" is from T0 plus 9 minutes to T0 plus 15 minutes, corresponding to a time interval with 95% confidence. The triggering probability also includes the uncertainty range. The probability distribution is calculated using the Monte Carlo simulation method, with an average triggering probability of 0.647 corresponding to a 95% confidence interval of 0.58 to 0.71.

[0058] The propagation path involves the types and number of system components, and a component classification system is maintained. This includes system component nodes such as servers, storage devices, and network devices; business process nodes such as user authentication, data processing, and report generation; and data flow nodes such as database access, file transfer, and message queues. For the propagation subgraph of C1, the system component nodes include 5 servers, 3 storage arrays, and 2 network switches, totaling 10 system components. The business process nodes involve 8 key business processes such as user login, data query, and backup and recovery. The data flow nodes include 12 database connections, 6 file access paths, and 4 message transmission channels, totaling 22 data flows. The impact range value is calculated by weighted summation, with the system component weight set to 3, the business process weight set to 2, and the data flow weight set to 1. The impact range value of C1 is 10 multiplied by 3 plus 8 multiplied by 2 plus 22 multiplied by 1, which equals 68.

[0059] By comparing the graph structure features of the current alarm event cluster and the historical event cluster, the similarity algorithm uses the graph edit distance method to calculate the minimum number of edit operations required to transform one graph structure into another. Edit operations include basic transformations such as node insertion, node deletion, edge insertion, edge deletion, and weight modification. The source subgraph of the current event cluster C1 contains 15 nodes and 23 edges, while the source subgraph of the historical event cluster H3 contains 18 nodes and 27 edges. During the similarity calculation, the number of common nodes and the number of common edges of the two graph structures are identified as 12. The overall structural similarity is obtained by weighted averaging of node similarity and edge similarity. The structural similarity between C1 and H3 is the average of 12 divided by 15 plus 19 divided by 23, which equals 0.87, exceeding the preset similarity threshold of 0.75.

[0060] Key information such as processing strategies, execution time, and recovery effects were obtained from similar historical event clusters. The processing records of historical event cluster H3 show that three processing measures were adopted: storage controller restart, data migration, and backup device activation. The total processing time was 45 minutes, the system recovery rate reached 92%, and the number of derived alarms was 3. The effect data under different processing time was extracted. The recovery rate of processing within 15 minutes was 78%, the recovery rate of processing within 30 minutes was 85%, and the recovery rate of processing within 60 minutes was 95%. The probability of derived alarms increased exponentially with the processing delay. The probability of derived alarms was 0.15 for processing within 15 minutes, 0.28 for processing within 30 minutes, and 0.52 for processing within 60 minutes.

[0061] Multiple regression analysis was used to establish the predictive relationship between processing time, system recovery status, and the probability of derived alarms. The model was trained using processing data from 200 similar historical events. The regression equations of time-recovery rate and time-derived probability were fitted using the least squares method. For the C1 event cluster, the model predicted a system recovery rate of 81% and a derived alarm probability of 0.12 within 15 minutes, a recovery rate of 88% and a derived alarm probability of 0.25 within 30 minutes, and a recovery rate of 94% and a derived alarm probability of 0.48 within 60 minutes. The urgency of processing was determined by a comprehensive evaluation of the rate of decline in recovery rate and the rate of increase in derived probability. The urgency score for C1 was 0.73, which belongs to the high urgency level.

[0062] The final processing priority is determined by combining the comprehensive impact range value and the urgency of processing using a weighted linear combination method. The impact range value is normalized by dividing the original value of 68 by the maximum impact range value of 120 in the system, resulting in a normalized impact range of 0.57. The priority score is calculated by multiplying the impact range weight of 0.6 by 0.57 and the urgency weight of 0.4 by 0.73, resulting in a comprehensive priority score of 0.634, which is used for processing sorting and resource allocation decisions for alarm event clusters.

[0063] This method enables intelligent assessment of alarm priorities, helping operations and maintenance personnel to address the most critical issues first, thereby improving system reliability and user experience.

[0064] In one optional implementation, based on the priority score of each alarm event cluster, combined with the availability of operational resources and alarm processing capacity thresholds, an adaptive filtering strategy is used to filter alarm event clusters, retaining those requiring immediate processing and suppressing those that can be delayed or are redundant, resulting in filtered alarm event clusters, including: Obtain the current availability status information of operation and maintenance resources, and calculate the alarm processing capacity threshold at the current moment by combining the average processing time and average resource consumption of historical alarm event clusters. Construct the component dependency propagation tree for each alarm event cluster, and calculate the tree edit distance and root node consistency between any two component dependency propagation trees. If the tree edit distance is less than the tree structure difference threshold and the root node consistency is true, then mark the corresponding alarm event cluster as a structurally redundant cluster pair. Alarm event clusters with low priority scores in the structural redundancy cluster pair are marked as redundant alarm event clusters and removed, while alarm event clusters with high priority scores in the structural redundancy cluster pair are retained, resulting in the redundancy-removed alarm event clusters. Based on the priority score, the alarm event clusters after removing redundancy are sorted in descending order. Alarm event clusters are selected sequentially from the sorting results until the alarm processing capacity threshold is reached. These clusters are then marked as emergency alarm event clusters, and the remaining alarm event clusters are marked as alarm event clusters that can be delayed, thus obtaining the filtered alarm event clusters.

[0065] In this specific implementation, the current availability of operational resources is obtained through a monitoring interface, including the number of available engineers, remaining server computing resources, and network bandwidth resources. Processing records for various alarm event clusters over the past 30 days are extracted from the alarm processing history database. The average processing time and average resource consumption for each alarm event cluster are calculated. For example, for network congestion alarm event clusters, the average processing time is 45 minutes, requiring an average of 1.5 engineers and 2 diagnostic server resources; for application service anomaly alarm event clusters, the average processing time is 30 minutes, requiring an average of 1 engineer and 1 diagnostic server resource. Based on the current availability of operational resources and historical average resource consumption data, the maximum number of alarm event clusters that can be processed in parallel at the current moment is calculated, i.e., the alarm processing capacity threshold. For example, if there are currently 3 available engineers and 5 available diagnostic servers, the current alarm processing capacity threshold is calculated to be 4 network alarm event clusters or 6 application service alarm event clusters.

[0066] For each alarm event cluster, a component dependency propagation tree is constructed. The root node of the component dependency propagation tree is the core component that caused the alarm, the child nodes are the related components that are affected, and the edges represent the dependencies between components. For example, for the alarm event cluster of high CPU utilization of database server A, the root node of its component dependency propagation tree is "database server A". The first-level child nodes include application servers that depend on the database, such as "application server B" and "application server C". The second-level child nodes include web front-end servers that depend on these application servers. The tree edit distance between any two component dependency propagation trees is calculated. The tree edit distance is obtained by calculating the minimum number of node deletion, insertion, and replacement operations required to transform from one tree to another. At the same time, it is checked whether the root nodes of the two trees are consistent. For example, two consecutive high CPU utilization alarms from database server A will generate two component dependency propagation trees with similar structures. Their tree edit distance is 2 (only two nodes are different), and the root node of both is "database server A". The root node consistency is true. The preset tree structure difference threshold is 5. If the edit distance of the two trees is less than 5 and the root nodes are the same, the corresponding two alarm event clusters will be marked as structurally redundant cluster pairs.

[0067] For the identified structurally redundant cluster pairs, their priority scores are compared. The alarm event cluster with the lower priority score in the structurally redundant cluster pair is marked as a redundant alarm event cluster and removed from the processing queue. For example, for two database CPU utilization alarm event clusters with similar structures, one has a priority score of 85 and the other has a score of 78. The alarm event cluster with a score of 85 is retained, and the alarm event cluster with a score of 78 is removed, resulting in the set of alarm event clusters after redundancy removal.

[0068] Based on priority scores, the alarm event clusters after redundancy removal are sorted in descending order. Assuming the priority scores of the sorted alarm event clusters are 95, 92, 88, 85, 80, 75, and 70, alarm event clusters are selected sequentially from the sorted results, and the total resource requirement of the selected alarm event clusters is calculated. For example, after selecting alarm event clusters with priority scores of 95, 92, 88, and 85, a total of 5 engineers are needed, but only 3 engineers are currently available, exceeding the current alarm processing capacity threshold. Taking a step back, alarm event clusters with priority scores of 95, 92, and 88 are selected as emergency alarm event clusters, requiring 3.5 engineers, close to but not exceeding the available resources. These alarm event clusters are marked as emergency alarm event clusters and immediately allocated resources for processing. The remaining alarm event clusters with priority scores of 85, 80, 75, and 70 are marked as alarm event clusters that can be delayed and placed in a delayed processing queue, waiting for resources to be released before processing.

[0069] The filtered alarm event clusters (including emergency alarm event clusters and alarm event clusters that can be delayed) are sent to the alarm processing scheduling module. The alarm processing scheduling module allocates resources and schedules processing according to the tag type. At the same time, it records the filtering decision results and actual processing status for subsequent optimization of alarm processing capacity threshold calculation and redundancy judgment strategy.

[0070] Through the above implementation method, the system can adaptively filter alarm event clusters according to the current operation and maintenance resource status, ensuring that the most important alarms are processed in a timely manner, while avoiding redundant alarms from consuming valuable operation and maintenance resources, thereby improving operation and maintenance efficiency and system reliability.

[0071] In one optional implementation, a component dependency propagation tree for each alarm event cluster is constructed, and the tree edit distance and root node consistency between any two component dependency propagation trees are calculated. If the tree edit distance is less than a tree structure difference threshold and the root node consistency is true, then the corresponding alarm event cluster is marked as a structurally redundant cluster pair, including: For each alarm event cluster, extract the system component nodes involved, construct a component dependency propagation tree based on the occurrence time of the corresponding alarm event, take the system component node corresponding to the root alarm event as the root node, and the system component node corresponding to the derived alarm event as the child node, and describe the abnormal propagation dependency relationship between system component nodes through directed edges. Perform tree structure matching analysis on the component dependency propagation trees of any two alarm event clusters, transform the component dependency propagation tree of the first alarm event cluster into the component dependency propagation tree of the second alarm event cluster, calculate the number of node insertion operations, node deletion operations and node replacement operations to be performed, and obtain the tree edit distance. Determine whether the system component nodes corresponding to the root nodes of the dependency propagation trees of two components are the same system component node to obtain root node consistency. If the tree edit distance is less than the tree structure difference threshold and the root node consistency is true, then mark the corresponding alarm event cluster as a structural redundancy cluster pair.

[0072] In this embodiment, a component dependency propagation tree needs to be constructed for each alarm event cluster. The component dependency propagation tree is a directed tree structure that describes the fault propagation path. Taking a telecommunications network system as an example, the system consists of components such as server A, router B, switch C, and database D. Assume that two alarm event clusters have occurred in the system: event cluster 1 contains 6 alarm records and event cluster 2 contains 5 alarm records.

[0073] For alarm event cluster 1, the component nodes involved and their alarm occurrence times are extracted: Server A (10:05:12), Router B (10:05:35), Switch C (10:05:58), Database D (10:06:22), Application Service E (10:06:45), and Load Balancer F (10:07:10). Based on the chronological order, Server A can be identified as the component node corresponding to the root alarm event, i.e., the root node. From the perspective of time propagation, the anomaly of Server A leads to the anomalies of Router B and Switch C, the anomaly of Switch C leads to the anomaly of Database D, and the anomaly of Database D propagates to Application Service E and Load Balancer F. Therefore, in the constructed component dependency propagation tree, Server A is the root node, Router B and Switch C are its child nodes, Database D is a child node of Switch C, and Application Service E and Load Balancer F are child nodes of Database D.

[0074] For alarm event cluster 2, the component nodes and alarm times are extracted as follows: server A (15:12:08), router B (15:12:33), switch C (15:12:59), database D (15:13:25), and application service E (15:13:50). In the constructed component dependency propagation tree, server A is the root node, router B and switch C are its child nodes, database D is a child node of switch C, and application service E is a child node of database D.

[0075] After the component dependency propagation tree is constructed, the tree edit distance between the two trees is calculated. The tree edit distance refers to the minimum number of operations required to transform one tree into another. The operations include node insertion, node deletion, and node replacement. In this embodiment, transforming the component dependency propagation tree of event cluster 1 into the component dependency propagation tree of event cluster 2 requires the following operation: deleting the load balancer F node, which requires 1 deletion operation. Therefore, the tree edit distance between the two trees is 1.

[0076] Assuming the preset tree structure difference threshold is 3, meaning that a maximum of 3 edit operations are allowed between two trees, since the calculated tree edit distance is 1, which is less than the threshold of 3, the two trees are considered structurally similar.

[0077] To determine if the root nodes of the two trees are consistent, we check the root nodes of the component dependency propagation trees of event cluster 1 and event cluster 2. We find that they are both server A, belonging to the same system component node, so the root node consistency is true.

[0078] Since the tree edit distance is less than the tree structure difference threshold and the root node consistency is true, event cluster 1 and event cluster 2 are marked as a structurally redundant cluster pair. This indicates that the two alarm event clusters represent the same type of system failure, even though they occur at different points in time.

[0079] In practical applications, large-scale network systems may have hundreds or thousands of alarm event clusters. This method can effectively identify alarm event clusters with similar structures, reducing the analysis burden on operation and maintenance personnel. For example, in a certain communication network, 5,000 alarm event clusters were generated in one month. After analysis using this method, it was found that there were 1,200 pairs of structurally redundant clusters, which means that these alarm event clusters originated from similar failure modes.

[0080] The tree edit distance can be calculated using dynamic programming. Taking the component dependency propagation tree of event cluster 1 and event cluster 2 as an example, a table can be constructed, with rows and columns representing nodes of the two trees respectively. The value in the table cell represents the edit distance between the corresponding subtrees. The calculation starts from the leaf node and gradually fills the table upwards to obtain the edit distance between the two complete trees.

[0081] When determining the consistency of root nodes, we can not only determine whether the node identifiers are the same, but also consider the node's type, function and other attributes. For example, although two root nodes are different physical servers, if they are both database servers, they can be considered to be consistent in some application scenarios.

[0082] The tree structure difference threshold in this embodiment can be adjusted according to the actual system size and complexity. For small systems, a smaller threshold such as 1 or 2 can be set; for large and complex systems, a larger threshold such as 5 or higher can be set. Similarly, the criteria for determining the consistency of the root nodes can also be adjusted according to actual needs. It can be strict equality or functional equivalence.

[0083] The structurally redundant cluster pairs identified by the above methods can be further used for applications such as fault diagnosis, fault mode library construction, and fault prediction, thereby improving system operation and maintenance efficiency and service quality.

[0084] In one optional implementation, the filtered alarm event clusters are distributed to corresponding operation and maintenance processing units for processing through a preset operation and maintenance responsibility mapping relationship, and the actual processing results and processing timeliness data are collected as feedback information output, including: Based on the resource ownership information and service type identifier of the filtered alarm event clusters, the target operation and maintenance processing unit corresponding to each alarm event cluster is determined through the preset operation and maintenance responsibility mapping relationship, and then distributed to the target operation and maintenance processing unit. In the target operation and maintenance processing unit, based on the fault feature information in the filtered alarm event cluster, fault location and repair operations are performed to generate actual processing results containing fault root cause identification and repair measure records; the time interval from the distribution time of the filtered alarm event cluster to the processing completion time is calculated to obtain processing timeliness data; The actual processing result is associated with and encapsulated with the processing time data to form feedback information, which is then output to the terminal device.

[0085] In this embodiment, based on the resource ownership information and service type identifier of the filtered alarm event clusters, the target operation and maintenance processing unit corresponding to each alarm event cluster is determined through a preset operation and maintenance responsibility mapping relationship. This operation and maintenance responsibility mapping relationship can be stored in the database in the form of a configuration table. For example, a typical mapping relationship configuration table includes fields such as: resource ownership ID, service type identifier, operation and maintenance processing unit ID, priority, working time period, etc. When an alarm event cluster containing "resource ownership: network device cluster A" and "service type: core network service" is received, the configuration table is queried to find the corresponding target operation and maintenance processing unit as "network core group B", and the alarm event cluster is distributed to the processing unit through message queue or API call.

[0086] To ensure accurate distribution of alarm event clusters, a multi-level matching strategy is adopted: priority is given to matching the exact combination of resource ownership and service type; if no exact match is found, matching is performed based on resource ownership; if no match is found again, matching is performed based on service type; if no match is found again, the alarm event cluster is distributed to the default processing unit. During the distribution process, the distribution time information is recorded in the format "year-month-day hour:minute:second.millisecond", for example, "2023-11-20 14:30:25.345". This information is used for subsequent processing time calculation.

[0087] In the target operation and maintenance processing unit, based on the fault characteristic information in the filtered alarm event cluster, fault location and repair operations are performed. The fault location operation is implemented through a multi-level diagnostic process. Based on the fault characteristic information in the alarm event cluster, key indicator anomalies are extracted, such as "CPU utilization exceeds 95% for 5 consecutive minutes". A preliminary diagnosis is performed through a preset fault decision tree. If a characteristic pattern related to "memory leak" is found, an automated diagnostic tool is called for in-depth analysis. For example, the memory analysis tool is used to locate the specific problematic module "data processing service - cache management component" and is compared and verified with similar cases in the historical fault database to confirm that the root cause of the fault is "memory leak caused by the improper release of cached objects in the data processing service".

[0088] The repair operation executes the corresponding processing flow based on the identified root cause of the fault: For known fault types, preset repair scripts can be executed automatically, such as "restarting the data processing service" or "cleaning up expired cache objects"; for complex faults requiring manual intervention, auxiliary tools are provided to support operations and maintenance personnel in performing targeted operations, such as "providing a memory analysis report and guiding operations and maintenance personnel to modify cache management parameters". During the repair process, the system records all executed operation steps, including operation type, execution time, execution result and other information, such as "Operation: Restart the data processing service, Time: 2023-11-20 14:45:30, Result: Service successfully restarted, CPU utilization returned to normal (current value 25%)".

[0089] After the repair operation is completed, the actual processing result is generated, which includes the root cause identifier of the fault and the repair measures record. The root cause identifier adopts a hierarchical structure, including device category, component type, fault type, and specific fault point, such as "network device - switch - configuration error - VLAN configuration conflict". The repair measures record describes in detail the operation steps performed and their effects, such as "modify the VLAN configuration of switch port 12, change it from VLAN20 to VLAN30, network connectivity is restored to normal, and link bandwidth is restored to the expected value of 10Gbps".

[0090] The time interval from the time the filtered alarm event cluster was distributed to the time the processing was completed is calculated to obtain the processing timeliness data. The time interval is calculated to the second. For example, if the alarm event cluster was distributed at "2023-11-20 14:30:25" and the processing was completed at "2023-11-20 15:10:45", then the processing timeliness is "40 minutes and 20 seconds". This processing timeliness is compared with the historical average processing time of similar faults. For example, "The processing time of this time is 40 minutes and 20 seconds, which is lower than the average processing time of 55 minutes and 30 seconds for similar faults, and the processing efficiency is improved by 27.2%".

[0091] The actual processing results are associated and encapsulated with processing time data to form feedback information, which is then output to the terminal device. The data structure of the feedback information includes: alarm event cluster ID, resource ownership information, service type identifier, fault root cause identifier, remediation measure record, distribution time, completion time, processing time, and processing efficiency evaluation. The terminal device can receive this feedback information through a web interface, mobile application, or API interface. For example, the operation and maintenance management platform displays "Alarm ID: AL20231120143025, Resource Ownership: Data Processing Cluster C, Service Type: Cache Service, Fault Root Cause: Memory Leak - Cache Object Not Released, Remediation Measures: Restart Service and Optimize Cache Parameter Configuration, Distribution Time: 2023-11-20 14:30:25, Completion Time: 2023-11-20 15:10:45, Processing Time: 40 minutes and 20 seconds, Efficiency Evaluation: Excellent (27.2% improvement over average)".

[0092] Feedback information is also stored in the fault knowledge base for rapid identification and optimization of similar faults in the future. At the same time, it serves as an important data source for operation and maintenance performance evaluation and system improvement. Through the continuous accumulation of feedback information, the mapping relationship of operation and maintenance responsibilities can be continuously optimized, and the distribution accuracy and processing efficiency of alarm event clusters can be improved.

[0093] This invention provides an intelligent filtering and hierarchical processing system for operation and maintenance alarms based on an adaptive algorithm, comprising: The first unit is used to acquire alarm events to be processed, perform semantic parsing and temporal pattern recognition on each alarm event to be processed, extract its semantic feature vector and temporal correlation features, and obtain alarm features. The second unit is used to dynamically cluster the alarm events to be processed based on the alarm features through an adaptive similarity measurement mechanism to obtain multiple alarm event clusters. The third unit is used to calculate the scope of impact and urgency of each alarm event cluster based on the forward causal propagation subgraph and the backward causal tracing subgraph of each alarm event cluster, combined with the processing data of historical alarm event clusters, and to determine the priority score of each alarm event cluster. The fourth unit is used to filter alarm event clusters based on the priority score of each alarm event cluster, combined with the availability status of operation and maintenance resources and alarm processing capacity thresholds, through an adaptive filtering strategy. It retains alarm event clusters that need to be processed immediately and suppresses alarm event clusters that can be delayed or are redundant, thus obtaining the filtered alarm event clusters. The fifth unit is used to distribute the filtered alarm event clusters to the corresponding operation and maintenance processing units for processing through a preset operation and maintenance responsibility mapping relationship, and to collect the actual processing results and processing time data as feedback information output.

[0094] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0095] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0096] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for intelligent filtering and hierarchical processing of operation and maintenance alarms based on adaptive algorithms, characterized in that, include: Acquire alarm events to be processed, perform semantic parsing and temporal pattern recognition on each alarm event to be processed, extract its semantic feature vector and temporal correlation features, and obtain alarm features; Based on the alarm features, the alarm events to be processed are dynamically clustered through an adaptive similarity measurement mechanism to obtain multiple alarm event clusters; Based on the forward causal propagation subgraph and backward causal tracing subgraph of each alarm event cluster, and combined with the processing data of historical alarm event clusters, the scope of impact and urgency are calculated to determine the priority score of each alarm event cluster. Based on the priority score of each alarm event cluster, combined with the availability status of operation and maintenance resources and the alarm processing capacity threshold, an adaptive filtering strategy is used to filter alarm event clusters, retaining alarm event clusters that need to be processed immediately and suppressing alarm event clusters that can be delayed or are redundant, thus obtaining the filtered alarm event clusters. By using a preset operation and maintenance responsibility mapping relationship, the filtered alarm event clusters are distributed to the corresponding operation and maintenance processing units for processing, and the actual processing results and processing time data are collected as feedback information output.

2. The method according to claim 1, characterized in that, Semantic parsing and temporal pattern recognition are performed on each pending alarm event to extract its semantic feature vector and temporal correlation features, resulting in alarm features, including: Semantic parsing is performed on the description information of each alarm event to be processed. The entity objects, attribute types and status descriptions of the alarm events to be processed are extracted through lexical analysis and syntactic analysis. Semantic mapping is performed on them based on a pre-built operation and maintenance semantic knowledge base to obtain the semantic feature vector of each alarm event to be processed. The time sequence pattern recognition is performed on the alarm events to be processed. By analyzing the occurrence timestamps and durations of each alarm event to be processed, a time sequence correlation matrix is ​​constructed. Based on the time sequence correlation matrix, the temporal sequence relationship and time sequence periodicity pattern between each alarm event to be processed are identified. The time sequence periodicity pattern represents the recurrence pattern of alarm events in the time dimension. Based on the semantic feature vector, the temporal sequence relationship, and the temporal periodicity pattern, semantic and temporal joint encoding is performed on each alarm event to be processed to obtain the alarm features of each alarm event to be processed.

3. The method according to claim 1, characterized in that, Based on the alarm features, the alarm events to be processed are dynamically clustered using an adaptive similarity measurement mechanism to obtain multiple alarm event clusters, including: The system is divided into multiple time-series stages. Based on the alarm features, the distribution density value of the alarm events to be processed in each time-series stage is calculated. Based on the semantic feature vector of the alarm events to be processed, a semantic distribution map is constructed in the semantic space. The local semantic density value and global semantic outlier value of each alarm event to be processed in the semantic distribution map are calculated. A multi-level similarity calculation model is constructed. For alarm events to be processed in the same time series, the similarity is calculated based on the local semantic density value and weights are assigned. For alarm events in different time series, the similarity is calculated based on the global semantic outlier value and the distribution density value and weights are assigned. Based on the multi-level similarity calculation model, the comprehensive similarity value between each alarm event to be processed is calculated, and clustering is performed according to the comprehensive similarity value. Alarm events to be processed that meet the clustering conditions are divided into the same alarm event cluster, resulting in multiple alarm event clusters.

4. The method according to claim 1, characterized in that, Based on the forward causal propagation subgraph and backward causal tracing subgraph of each alarm event cluster, and combined with the processing data of historical alarm event clusters, the scope of impact and urgency are calculated to determine the priority score of each alarm event cluster, including: Based on the pre-constructed alarm event graph, extract the causal outgoing edge set and causal incoming edge set of each alarm event cluster, and construct the forward causal propagation subgraph and the backward causal tracing subgraph of each alarm event cluster. Based on the aforementioned forward causal propagation subgraph, propagation path simulation is performed to predict the triggering time window and triggering probability of downstream alarm events in each propagation path, and the total number of system component nodes, business process nodes and data flow nodes involved are counted to calculate the impact range value of each alarm event cluster. Based on the backward causal tracing subgraph, the structural similarity between each alarm event cluster and the historical alarm event cluster is calculated. Historical alarm event clusters with structural similarity greater than the similarity threshold are selected, their historical processing data is obtained, a historical processing effect evaluation model is constructed, and the system recovery status of each alarm event cluster under different processing time conditions and the probability of occurrence of derived alarm events are predicted to obtain the processing urgency of each alarm event cluster. Based on the impact range value and the processing urgency, calculate the priority score for each alarm event cluster.

5. The method according to claim 1, characterized in that, Based on the priority scores of each alarm event cluster, combined with the availability of operational resources and alarm processing capacity thresholds, an adaptive filtering strategy is used to filter alarm event clusters, retaining those requiring immediate processing and suppressing those that can be delayed or are redundant. The resulting filtered alarm event clusters include: Obtain the current availability status information of operation and maintenance resources, and calculate the alarm processing capacity threshold at the current moment by combining the average processing time and average resource consumption of historical alarm event clusters. Construct the component dependency propagation tree for each alarm event cluster, and calculate the tree edit distance and root node consistency between any two component dependency propagation trees. If the tree edit distance is less than the tree structure difference threshold and the root node consistency is true, then mark the corresponding alarm event cluster as a structurally redundant cluster pair. Alarm event clusters with low priority scores in the structural redundancy cluster pair are marked as redundant alarm event clusters and removed, while alarm event clusters with high priority scores in the structural redundancy cluster pair are retained, resulting in the redundancy-removed alarm event clusters. Based on the priority score, the alarm event clusters after removing redundancy are sorted in descending order. Alarm event clusters are selected sequentially from the sorting results until the alarm processing capacity threshold is reached. These clusters are then marked as emergency alarm event clusters, and the remaining alarm event clusters are marked as alarm event clusters that can be delayed, thus obtaining the filtered alarm event clusters.

6. The method according to claim 5, characterized in that, Construct the component dependency propagation tree for each alarm event cluster, and calculate the tree edit distance and root node consistency between any two component dependency propagation trees. If the tree edit distance is less than the tree structure difference threshold and the root node consistency is true, then mark the corresponding alarm event cluster as a structurally redundant cluster pair, including: For each alarm event cluster, extract the system component nodes involved, construct a component dependency propagation tree based on the occurrence time of the corresponding alarm event, take the system component node corresponding to the root alarm event as the root node, and the system component node corresponding to the derived alarm event as the child node, and describe the abnormal propagation dependency relationship between system component nodes through directed edges. Perform tree structure matching analysis on the component dependency propagation trees of any two alarm event clusters, transform the component dependency propagation tree of the first alarm event cluster into the component dependency propagation tree of the second alarm event cluster, calculate the number of node insertion operations, node deletion operations and node replacement operations to be performed, and obtain the tree edit distance. Determine whether the system component nodes corresponding to the root nodes of the dependency propagation trees of two components are the same system component node to obtain root node consistency. If the tree edit distance is less than the tree structure difference threshold and the root node consistency is true, then mark the corresponding alarm event cluster as a structural redundancy cluster pair.

7. The method according to claim 1, characterized in that, Based on a pre-defined operation and maintenance responsibility mapping relationship, the filtered alarm event clusters are distributed to the corresponding operation and maintenance processing units for processing, and the actual processing results and processing timeliness data are collected as feedback information output, including: Based on the resource ownership information and service type identifier of the filtered alarm event clusters, the target operation and maintenance processing unit corresponding to each alarm event cluster is determined through the preset operation and maintenance responsibility mapping relationship, and then distributed to the target operation and maintenance processing unit. In the target operation and maintenance processing unit, based on the fault feature information in the filtered alarm event cluster, fault location and repair operations are performed to generate actual processing results containing fault root cause identification and repair measure records; the time interval from the distribution time of the filtered alarm event cluster to the processing completion time is calculated to obtain processing timeliness data; The actual processing result is associated with and encapsulated with the processing time data to form feedback information, which is then output to the terminal device.

8. An intelligent filtering and hierarchical processing system for operation and maintenance alarms based on adaptive algorithms, used to implement the method as described in any one of claims 1-7, characterized in that, include: The first unit is used to acquire alarm events to be processed, perform semantic parsing and temporal pattern recognition on each alarm event to be processed, extract its semantic feature vector and temporal correlation features, and obtain alarm features. The second unit is used to dynamically cluster the alarm events to be processed based on the alarm features through an adaptive similarity measurement mechanism to obtain multiple alarm event clusters. The third unit is used to calculate the scope of impact and urgency of each alarm event cluster based on the forward causal propagation subgraph and the backward causal tracing subgraph of each alarm event cluster, combined with the processing data of historical alarm event clusters, and to determine the priority score of each alarm event cluster. The fourth unit is used to filter alarm event clusters based on the priority score of each alarm event cluster, combined with the availability status of operation and maintenance resources and alarm processing capacity thresholds, through an adaptive filtering strategy. It retains alarm event clusters that need to be processed immediately and suppresses alarm event clusters that can be delayed or are redundant, thus obtaining the filtered alarm event clusters. The fifth unit is used to distribute the filtered alarm event clusters to the corresponding operation and maintenance processing units for processing through a preset operation and maintenance responsibility mapping relationship, and to collect the actual processing results and processing time data as feedback information output.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images