Alarm plan generation method and device, equipment, medium and program product

Abstract

The invention provides an alarm plan generation method and device, equipment, a medium and a program product, and can solve the problem that the effect of an alarm plan formulated depending on operation and maintenance personnel is poor. The method comprises the steps of obtaining a first target operation instruction set in a first time period based on an obtained first abnormal index set in an alarm time period; inputting the first abnormal index set and the first target operation instruction set into a first incidence relation model; obtaining a second target operation instruction set output by the first incidence relation model; and generating an alarm plan based on the operation instruction combination with the highest priority in the N operation instruction combinations, each operation instruction combination comprises at least one abnormal index in the first abnormal index set, at least one first target operation instruction in the first target operation instruction set and at least one second target operation instruction in the second target operation instruction set, and N is an integer greater than or equal to 1. According to the invention, the generation efficiency of the alarm plan can be improved.

Description

Technical Field

[0001] This application relates to the field of IT infrastructure technology, and in particular to a method, apparatus, device, medium and program product for generating alarm plans. Background Technology

[0002] In the IT field, the secure and stable operation of systems and platforms is crucial for the normal operation of related businesses. The secure and stable operation of systems and platforms relies on comprehensive alarm and contingency plans. Upon receiving alarm information, these plans enable accurate problem localization and timely and accurate activation of corresponding contingency measures, ensuring rapid fault elimination and rapid system and platform recovery.

[0003] Currently, alarm contingency plans largely rely on the experience of operations and maintenance personnel. When different people handle the same alarm, their operations often differ due to differences in individual skill levels and business experience. This makes it impossible to guarantee the timeliness and effectiveness of the alarm recovery process, resulting in poor effectiveness of alarm contingency plans developed by operations and maintenance personnel. Summary of the Invention

[0004] This application provides an alarm plan generation method, apparatus, device, medium, and program product that can solve the problem that alarm plans developed by maintenance personnel are ineffective.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a method for generating alarm plans, including:

[0007] Based on the first abnormal indicator set within the acquired alarm time period, a first target operation instruction set within the first time period is acquired, wherein the alarm time period and the first time period are consecutive time periods, and the first time period is located before the alarm time period.

[0008] The first set of abnormal indicators and the first set of target operation instructions are input into the first association model;

[0009] Obtain the second target operation instruction set output by the first association relationship model. The second target operation instruction set is a set of subsequent operation instructions in the first association relationship model that correspond to the first abnormal indicator set and the first target operation instruction set.

[0010] An alarm plan is generated based on the highest priority operation instruction combination among N operation instruction combinations. Each operation instruction combination includes at least one abnormal indicator from the first abnormal indicator set, at least one first target operation instruction from the first target operation instruction set, and at least one second target operation instruction from the second target operation instruction set, where N is an integer greater than or equal to 1.

[0011] Optionally, after outputting the second target operation instruction set and before generating an alarm plan based on the highest priority operation instruction combination among N operation instruction combinations, the method further includes:

[0012] Input the second target operation instruction set into the second association model;

[0013] If there is no second abnormal indicator set corresponding to the second target operation instruction set in the second association model, a first target priority is obtained. The first target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set in the first association model.

[0014] Optionally, the method further includes:

[0015] If a second set of abnormal indicators exists in the second association model that corresponds to the second target operation instruction set, the second target operation instruction set and the second set of abnormal indicators are input into the first association model.

[0016] If there is no third target operation instruction set in the first association model, the second target priority is obtained. The second target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set. The third target operation instruction set is the set of subsequent operation instructions in the first association model that correspond to the second target operation instruction set and the second abnormal indicator set.

[0017] Optionally, the method further includes:

[0018] If a third target operation instruction set exists in the first association model, the priority of the third target is obtained. The priority of the third target is the priority of multiple manipulation instruction combinations corresponding to the first association model and the third target operation instruction set. The third target operation instruction set is the set of subsequent operation instructions in the first association model that correspond to the second target operation instruction set and the second abnormal indicator set. The priority of the third target is greater than the priority of the second target.

[0019] Optionally, the first association model includes M operation combination sets, which are generated based on the instruction features of the first historical operation instruction set and the second historical operation instruction set. The instruction features include at least instruction type, execution time, and operation object, where M is an integer greater than 1.

[0020] Optionally, the step of generating an alarm plan based on the highest priority combination of N operation instructions includes:

[0021] Obtain the confidence and support of N combinations of operation instructions;

[0022] Based on the confidence level and the support level, the priority of N operation instruction combinations is obtained;

[0023] An alarm plan is generated based on the highest priority combination of N operation instructions.

[0024] Optionally, both the first association model and the second association model are generated using the Apriori algorithm.

[0025] Secondly, embodiments of this application provide an alarm plan generation device, comprising:

[0026] The first acquisition module is used to acquire a first target operation instruction set within a first time period based on a first abnormal indicator set within the acquired alarm time period, wherein the alarm time period and the first time period are consecutive time periods, and the first time period is located before the alarm time period.

[0027] The input module is used to input the first set of abnormal indicators and the first set of target operation instructions into the first association model;

[0028] The second acquisition module is used to acquire the second target operation instruction set output by the first association relationship model. The second target operation instruction set is a set of subsequent operation instructions in the first association relationship model that correspond to the first abnormal indicator set and the first target operation instruction set.

[0029] The generation module is used to generate an alarm plan based on the highest priority operation instruction combination among N operation instruction combinations. Each operation instruction combination includes at least one abnormal indicator in the first abnormal indicator set, at least one first target operation instruction in the first target operation instruction set, and at least one second target operation instruction in the second target operation instruction set, where N is an integer greater than or equal to 1.

[0030] Optionally, the device further includes:

[0031] Input the second target operation instruction set into the second association model;

[0032] If there is no second abnormal indicator set corresponding to the second target operation instruction set in the second association model, a first target priority is obtained. The first target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set in the first association model.

[0033] Optionally, the device further includes:

[0034] If a second set of abnormal indicators exists in the second association model that corresponds to the second target operation instruction set, the second target operation instruction set and the second set of abnormal indicators are input into the first association model.

[0035] If there is no third target operation instruction set in the first association relationship model, the second target priority is obtained. The second target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set.

[0036] Optionally, the device further includes:

[0037] If a third target operation instruction set exists in the first association model, the priority of the third target is obtained. The priority of the third target is the priority of multiple manipulation instruction combinations corresponding to the first association model and the third target operation instruction set. The third target operation instruction set is the set of subsequent operation instructions in the first association model that correspond to the second target operation instruction set and the second abnormal indicator set.

[0038] Optionally, the first association model includes M operation combination sets, which are generated based on the instruction features of the first historical operation instruction set and the second historical operation instruction set. The instruction features include at least instruction type, execution time, and operation object, where M is an integer greater than 1.

[0039] Optionally, the generation module includes:

[0040] The first acquisition unit is used to acquire the confidence and support of N combinations of operation instructions;

[0041] The second acquisition unit is used to obtain the priority of N operation instruction combinations based on the confidence level and the support level;

[0042] The generation unit is used to generate alarm plans based on the highest priority combination of operation instructions among N operation instruction combinations.

[0043] Optionally, both the first association model and the second association model are generated using the Apriori algorithm.

[0044] Thirdly, embodiments of this application provide an electronic device, including a transceiver and a processor, wherein the processor is used for:

[0045] The processor is used for:

[0046] Based on the first abnormal indicator set within the acquired alarm time period, a first target operation instruction set within the first time period is acquired, wherein the alarm time period and the first time period are consecutive time periods, and the first time period is located before the alarm time period.

[0047] The first set of abnormal indicators and the first set of target operation instructions are input into the first association model;

[0048] Obtain the second target operation instruction set output by the first association relationship model. The second target operation instruction set is a set of subsequent operation instructions in the first association relationship model that correspond to the first abnormal indicator set and the first target operation instruction set.

[0049] An alarm plan is generated based on the highest priority operation instruction combination among N operation instruction combinations. Each operation instruction combination includes at least one abnormal indicator from the first abnormal indicator set, at least one first target operation instruction from the first target operation instruction set, and at least one second target operation instruction from the second target operation instruction set, where N is an integer greater than or equal to 1.

[0050] Optionally, the processor is further configured to:

[0051] Input the second target operation instruction set into the second association model;

[0052] If there is no second abnormal indicator set corresponding to the second target operation instruction set in the second association model, a first target priority is obtained. The first target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set in the first association model.

[0053] Optionally, the processor is further configured to:

[0054] If a second set of abnormal indicators exists in the second association model that corresponds to the second target operation instruction set, the second target operation instruction set and the second set of abnormal indicators are input into the first association model.

[0055] If there is no third target operation instruction set in the first association model, the second target priority is obtained. The second target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set. The third target operation instruction set is the set of subsequent operation instructions in the first association model that correspond to the second target operation instruction set and the second abnormal indicator set.

[0056] Optionally, the processor is further configured to:

[0057] If a third target operation instruction set exists in the first association model, the priority of the third target is obtained. The priority of the third target is the priority of multiple manipulation instruction combinations corresponding to the first association model and the third target operation instruction set. The third target operation instruction set is the set of subsequent operation instructions in the first association model that correspond to the second target operation instruction set and the second abnormal indicator set. The priority of the third target is greater than the priority of the second target.

[0058] Optionally, the first association model includes M operation combination sets, which are generated based on the instruction features of the first historical operation instruction set and the second historical operation instruction set. The instruction features include at least instruction type, execution time, and operation object, where M is an integer greater than 1.

[0059] Optionally, the processor is specifically used for:

[0060] Obtain the confidence and support of N combinations of operation instructions;

[0061] Based on the confidence level and the support level, the priority of N operation instruction combinations is obtained;

[0062] An alarm plan is generated based on the highest priority combination of N operation instructions.

[0063] Optionally, both the first association model and the second association model are generated using the Apriori algorithm.

[0064] Fourthly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the alarm plan generation method described in the first aspect above.

[0065] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the alarm plan generation method described in the first aspect above.

[0066] Sixthly, embodiments of this application provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the alarm plan generation method described in the first aspect above.

[0067] In this embodiment, based on the first abnormal indicator set within the acquired alarm time period, a first target operation instruction set within the first time period is obtained. The alarm time period and the first time period are consecutive time periods, and the first time period precedes the alarm time period. The first abnormal indicator set and the first target operation instruction set are input into a first association model. A second target operation instruction set output by the first association model is obtained. The second target operation instruction set is a set of subsequent operation instructions corresponding to the first abnormal indicator set and the first target operation instruction set in the first association model. An alarm plan is generated based on the highest priority operation instruction combination among N operation instruction combinations. Each operation instruction combination includes at least one abnormal indicator from the first abnormal indicator set, at least one first target operation instruction from the first target operation instruction set, and at least one second target operation instruction from the second target operation instruction set, where N is an integer greater than or equal to 1. In this application, the alarm plan is generated by using the highest priority operation instruction combination among N operation combinations formed based on the first abnormal indicator set, the first target operation instruction set, and the second target operation instruction set output by the first association model, which can improve the generation efficiency of the alarm plan. Attached Figure Description

[0068] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0069] Figure 1 A flowchart illustrating the alarm plan generation method provided in this application embodiment;

[0070] Figure 2 A schematic diagram of the alarm plan generation device provided in the embodiments of this application;

[0071] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0072] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0073] The alarm plan generation method, apparatus, equipment, media, and program products proposed in this application will be further described below with reference to the accompanying drawings.

[0074] It should be understood that this application can be used for fault location of service platforms associated with terminal applications (APPs) that include at least one business scenario. Taking a certain payment APP as an example, if the "transfer" module of the payment APP is unresponsive, an alarm will occur. Based on this application, multiple alarm contingency plans can be generated, and their priorities and advantages and disadvantages will be given.

[0075] This application can also be used to generate alarm contingency plans for government and enterprise external service platforms that include at least one business scenario, such as a government-enterprise interoperability information service platform in a certain region or a government service platform. While avoiding greater impact, it can greatly improve the recovery speed of system anomalies and prevent business losses and customer churn caused by system failures.

[0076] Please see Figure 1 , Figure 1 This is a flowchart illustrating the alarm plan generation method provided in an embodiment of this application. Figure 1 As shown, the method includes:

[0077] Step 110: Based on the first abnormal indicator set within the acquired alarm time period, obtain the first target operation instruction set within the first time period.

[0078] Wherein, the alarm time period and the first time period are consecutive time periods, and the first time period is located before the alarm time period.

[0079] It should be understood that the alarm time period is the time period from the start time of the alarm to the end time of the alarm. The first time period is the time period before the alarm time period. For example, the first time period is the time period from 120 seconds before the alarm start time to the alarm start time.

[0080] The first set of abnormal indicators is the collection of indicators that reported abnormalities during the alarm period. In order to distinguish between the abnormal indicators, each abnormal indicator in the first set of abnormal indicators is usually labeled with an abnormal trend, such as: sudden increase, sudden decrease, below the threshold, above the threshold, etc.

[0081] In an optional embodiment, the first set of abnormal indicators may include abnormal indicators at the device layer, network layer, application layer, service layer, and environment layer. The device layer may include central processing unit (CPU) utilization, memory usage, disk I / O rate, etc.; the network layer may include network bandwidth utilization, transmission control protocol (TCP) retransmission rate, etc.; the application layer may include JVM heap memory utilization, interface response time, etc.; the service layer may include order conversion rate, payment success rate, etc.; and the environment layer may include data center temperature and humidity (sensors), mains power stability (uninterruptible power supply (UPS) monitoring), etc.

[0082] The first target operation instruction set is the set of operation instructions that may cause each abnormal indicator in the first abnormal indicator set within the first time period, based on the aforementioned first abnormal indicator set and by pushing back the first time period.

[0083] Step 120: Input the first abnormal indicator set and the first target operation instruction set into the first association model.

[0084] It should be understood that the first association model includes all operation instruction sets and all indicator item sets related to the alarm time in the historical operation instruction set library. The operation instruction sets related to the alarm time include all operation instructions before the alarm start time and all operation instructions after the alarm start time. The first association model also includes association rules generated based on all operation instruction sets and all indicator item sets related to the alarm time in the historical operation instruction set library.

[0085] In an optional embodiment, the first association model can be an association model of "preceding operation instruction set - abnormal indicator item set - subsequent operation instruction set" generated by analyzing historical data based on the historical operation instruction library.

[0086] In an optional embodiment, each operation instruction (all operation instructions before the alarm start time and all operation instructions after the alarm start time) can be tagged with three types of feature tags: instruction type, execution time, and operation object. The operations are then filtered, aggregated, and classified using these feature tags to generate a directed operation instruction set.

[0087] For example: filter instructions whose type is to view class tags; aggregate instructions that are continuous in time and operate on the same or similar objects into a directed operation instruction set in sequence; identify some loop or judgment instructions in the directed operation instruction set and mark them with features, such as the same loop number but different numbers can be classified into one category, and the same judgment statement is only considered to be in the same category when the judgment result is the same, etc.

[0088] Finally, a directed operation instruction set of "preceding operation instruction set - abnormal indicator item set - subsequent operation instruction set" is generated based on the time relationship between the instruction set and the alarm. The instruction set is then divided into two categories, namely the preceding operation instruction set and the subsequent operation instruction set, and stored in the historical instruction set library respectively.

[0089] Step 130: Obtain the second target operation instruction set output by the first association relationship model.

[0090] The second target operation instruction set is a set of subsequent operation instructions in the first association model that correspond to the first abnormal indicator set and the first target operation instruction set.

[0091] After the first set of abnormal indicators and the first set of target operation instructions are input into the first association model in step 120, the first association model obtains the second set of target operation instructions corresponding to the first set of abnormal indicators and the first set of target operation instructions based on the historical operation instruction set and association rules.

[0092] The second target operation instruction set is a set of subsequent operation instructions pre-stored in the first association model that correspond to the first abnormal indicator set and the first target operation instruction set.

[0093] Step 140: Generate an alarm plan based on the highest priority combination of operation instructions among the N combination of operation instructions.

[0094] Each combination of operation instructions includes at least one abnormal indicator from the first abnormal indicator set, at least one first target operation instruction from the first target operation instruction set, and at least one second target operation instruction from the second target operation instruction set, where N is an integer greater than or equal to 1.

[0095] It should be understood that the above-mentioned combination of operation instructions is a directed combination of the first abnormal indicator set, the first target operation instruction set, and the second target operation instruction set obtained in the first association model based on the first abnormal indicator set and the first target operation instruction set. Specifically, the directed combination of operation instructions is a combination of operation instructions formed based on time, namely, "preceding operation instruction - abnormal indicator - subsequent operation instruction".

[0096] Among them, the N operation instruction combinations are the set of each subsequent operation instruction in the second target operation instruction set, which corresponds to each abnormal indicator in the first abnormal indicator set and each preceding operation instruction in the first target operation instruction set in the first correlation model.

[0097] In this way, based on the first association model, the priority of N operation instruction combinations is obtained, and the priorities of the N operation instruction combinations are sorted. Finally, an alarm plan is generated based on the operation instruction combination with the highest priority.

[0098] In this embodiment, based on the first abnormal indicator set within the acquired alarm time period, a first target operation instruction set within the first time period is obtained. The alarm time period and the first time period are consecutive time periods, and the first time period precedes the alarm time period. The first abnormal indicator set and the first target operation instruction set are input into a first correlation model. A second target operation instruction set output by the first correlation model is obtained. The second target operation instruction set is a set of subsequent operation instructions corresponding to the first abnormal indicator set and the first target operation instruction set in the first correlation model. An alarm plan is generated based on the highest priority operation instruction combination among N operation instruction combinations. Each operation instruction combination includes at least one abnormal indicator from the first abnormal indicator set, at least one first target operation instruction from the first target operation instruction set, and at least one second target operation instruction from the second target operation instruction set, where N is an integer greater than or equal to 1. In this application, the alarm plan is generated by using the highest priority operation instruction combination among N operation combinations formed based on the first abnormal indicator set, the first target operation instruction set, and the second target operation instruction set output by the first correlation model, which can improve the generation efficiency of the alarm plan.

[0099] It should be understood that the above association rules can be pre-set evaluation indicator thresholds, where the evaluation indicator thresholds may include minimum confidence and minimum support.

[0100] In an optional embodiment, the minimum confidence level can be set to 60%, meaning the reliability of the association rule must be greater than 60%. The minimum support level can also be set to 20%, meaning that each first abnormal indicator in the first abnormal indicator set, and / or each first target operation instruction in the first target operation instruction set, and / or each second target operation instruction in the second target operation instruction set must have a probability of occurrence greater than 20% in the historical operation indicator set in the historical instruction library, and / or the historical abnormal indicator set.

[0101] In practical implementation, a single-item set can be generated first. This single-item set includes the occurrence count, support, and frequency of each first anomaly indicator, each first target operation instruction, and each second target operation instruction in the historical operation instruction library. Then, multiple single items in the single-item set with support greater than a first preset support and confidence greater than a first preset confidence are selected and self-joined to generate a multi-item set. Then, multiple multi-items in the multi-item set with support greater than a second preset support and confidence greater than a second preset confidence are selected. In this way, through repeated iterations, higher-order itemsets are generated based on low-order frequent itemsets, and infrequent itemsets are filtered out until no more higher-order itemsets are generated. Then the iteration ends, and the multi-item set with the highest confidence and the highest support is obtained, which is the combination of N operation instructions in the above embodiment.

[0102] Additionally, it should be noted that when the first target operation instruction in one of the N operation instruction combinations occurs, the first abnormal indicator will inevitably be generated, and the second target operation instruction will inevitably appear. In other words, the operation instruction combination has the highest priority, and an alarm plan for that operation instruction combination is generated.

[0103] Optionally, the step of generating an alarm plan based on the highest priority combination of N operation instructions includes:

[0104] Obtain the confidence and support of N combinations of operation instructions;

[0105] Based on the confidence level and the support level, the priority of N operation instruction combinations is obtained;

[0106] An alarm plan is generated based on the highest priority combination of N operation instructions.

[0107] Support refers to the frequency of occurrence of N operation instruction combinations in the historical operation instruction library.

[0108] For example, if a certain operation instruction combination appears once in the historical operation instruction library among N operation instruction combinations, and the historical operation instruction library includes a total of 4 operation instruction combinations, then the support of that operation instruction combination is 1 / 4, that is, the support of that operation instruction combination is 20%.

[0109] The confidence level is calculated based on association rules, using the antecedent (i.e., the first target operation instruction and the first abnormal indicator) and the consequence (the second target operation instruction) in a combination of N operation instructions.

[0110] In an alternative embodiment, frequent itemsets {X, Y} of “cause” and “effect” (X is cause, Y is effect) are used to generate rule X→Y, and the confidence (X→Y) = support (X∪Y) / support (X) is calculated.

[0111] For example, if the support rate of the operation instruction combination is 25%, and the support rate of the first abnormal indicator and the first target operation instruction in the operation instruction combination is 25%, then the confidence rate of the operation instruction combination can be obtained as 100%, i.e., 25% / 25% = 100%. Furthermore, the second target operation instruction in the operation instruction combination is a subsequent operation that is bound to occur, and the operation instruction combination has the highest priority, thereby generating an alarm plan for the operation instruction combination.

[0112] In this embodiment, by obtaining the confidence and support of N operation command combinations, the priority of the N operation command combinations is obtained, and an alarm plan is generated based on the operation command combination with the highest priority, which can improve the generation efficiency and accuracy of alarm plans.

[0113] In an optional embodiment, the priority can be calculated using the following formula:

[0114] U=a*K*J;

[0115] Where U is the priority, a is the coefficient parameter, K is the confidence level, and J is the support level.

[0116] Optionally, after outputting the second target operation instruction set and before generating an alarm plan based on the highest priority operation instruction combination among N operation instruction combinations, the method further includes:

[0117] Input the second target operation instruction set into the second association model;

[0118] It should be understood that after obtaining the second target operation instruction set, the second target operation instruction set can be input into the second association model, and then the priority of the N operation instruction combinations can be obtained based on the output of the second association model.

[0119] The second correlation model can be a correlation model of "preceding operation instruction set - abnormal indicator item set" generated by analyzing historical data based on the historical operation instruction library.

[0120] In an optional embodiment, each operation instruction (all operation instructions before the alarm start time and all operation instructions after the alarm start time) can be tagged with three types of feature tags: instruction type, execution time, and operation object. The operations are then filtered, aggregated, and classified using these feature tags to generate a directed operation instruction set.

[0121] For example: filter instructions whose type is to view class tags; aggregate instructions that are continuous in time and operate on the same or similar objects into a directed operation instruction set in sequence; identify some loop or judgment instructions in the directed operation instruction set and mark them with features, such as the same loop number but different numbers can be classified into one category, and the same judgment statement is only considered to be in the same category when the judgment result is the same, etc.

[0122] Finally, a directed operation instruction set of "preceding operation instruction set - abnormal indicator item set" is generated based on the time relationship between the instruction set and the alarm, and the preceding operation instruction set and the abnormal indicator item set are stored in the historical instruction set library respectively.

[0123] If there is no second abnormal indicator set corresponding to the second target operation instruction set in the second association model, a first target priority is obtained. The first target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set in the first association model.

[0124] It should be understood that at this time, the second target operation instruction set is input into the second association model as a preceding operation instruction. If there is no second abnormality index set in the second association model that causes an abnormality due to the second target operation instruction, the first target priority is obtained. The first target priority is the priority of the N operation instruction combinations corresponding to the second target operation instruction set in the first association model.

[0125] In an optional embodiment, the first target priority can be calculated using the following formula:

[0126] U=a*K*J;

[0127] Where U is the priority, a is the coefficient parameter, K is the confidence level, and J is the support level.

[0128] Optionally, the method further includes:

[0129] If a second set of abnormal indicators exists in the second association model that corresponds to the second target operation instruction set, the second target operation instruction set and the second set of abnormal indicators are input into the first association model.

[0130] If there is no third target operation instruction set in the first association relationship model, the second target priority is obtained. The second target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set.

[0131] In this way, by inputting the second target operation instruction set into the second association model, and if there is a second abnormal indicator set in the second association model that corresponds to the second target operation instruction set, the second target operation instruction set and the second abnormal indicator set are then input into the first association model to determine whether there is a third target operation instruction set in the first association model.

[0132] In the absence of a third target operation instruction set in the first association model, obtain the second target priority of N operation instruction combinations.

[0133] In an optional embodiment, the second target priority of the combination of N operation instructions can be calculated using the following formula:

[0134] U1 = b * U;

[0135] Where b is the coefficient and U is the priority of the first target.

[0136] Optionally, the method further includes:

[0137] If a third target operation instruction set exists in the first association model, the priority of the third target is obtained. The priority of the third target is the priority of multiple manipulation instruction combinations corresponding to the third target operation instruction set in the first association model. The third target operation instruction set is the set of subsequent operation instructions corresponding to the second target operation instruction set and the second abnormal indicator set in the first association model.

[0138] In this embodiment, by inputting the second target operation instruction set into the second association model, and if a second abnormal indicator set corresponding to the second target operation instruction set exists in the second association model, the second target operation instruction set and the second abnormal indicator set are then input into the first association model. If a third target operation instruction set corresponding to the second target operation instruction set and the second abnormal indicator set exists in the first association model, the third target priority of N operation instruction combinations is obtained. The third target priority is greater than the second target priority.

[0139] In an optional embodiment, the priority of the third target can be calculated using the following formula:

[0140] U2 = c * U;

[0141] Where U is the priority of the first objective, c is the coefficient calculated from the confidence K1 and support J1 obtained after the second substitution into the first association model, and c is always greater than b.

[0142] Optionally, the first association model includes M sets of operation instruction combinations, which are generated based on the instruction features of the first historical operation instruction set and the second historical operation instruction set. The instruction features include at least instruction type, execution time, and operation object, where M is an integer greater than 1.

[0143] It should be understood that the first historical operation instruction set is the previous operation instruction set, and the second historical operation instruction set is the subsequent operation instruction set, and both the first historical operation instruction set and the second historical operation instruction set are generated based on historical data analysis.

[0144] In this embodiment, by marking the instruction features of the first historical operation instruction set and the second historical operation instruction, the efficiency of the first association model in generating target operation instruction combinations can be improved, as can the efficiency of generating subsequent alarm plans.

[0145] In an optional embodiment, each operation instruction (all operation instructions before the alarm start time and all operation instructions after the alarm start time) can be tagged with three types of feature tags: instruction type, execution time, and operation object. The operations are then filtered, aggregated, and classified using these feature tags to generate a directed operation instruction set.

[0146] For example: filter instructions whose type is to view class tags; aggregate instructions that are continuous in time and operate on the same or similar objects into a directed operation instruction set in sequence; identify some loop or judgment instructions in the directed operation instruction set and mark them with features, such as the same loop number but different numbers can be classified into one category, and the same judgment statement is only considered to be in the same category when the judgment result is the same, etc.

[0147] Optionally, both the first association model and the second association model are generated using the Apriori algorithm.

[0148] It should be understood that the Apriori algorithm, based on historical data from a historical operation instruction library, mines its algorithmic rules to generate association rules.

[0149] In its implementation, the Apriori algorithm repeatedly scans the historical operation instruction database to calculate the support of the preceding operation instruction set, the anomaly indicator set, and the subsequent operation instruction set. This allows it to discover N operation instruction combinations formed by at least one preceding operation instruction from the preceding operation instruction set, at least one anomaly indicator from the anomaly indicator set, and one subsequent operation instruction from the subsequent operation instruction set, generating association rules. The core idea of ​​the Apriori algorithm is to use known frequent itemsets to generate new candidate itemsets and determine whether they are frequent itemsets by calculating their support.

[0150] For ease of understanding, the specific process of the training method of the first association relationship model provided by the present invention will be described below using a specific embodiment as an example.

[0151] Step 1: Collect and store the operation instructions and indicator data of the system in real time, and extract the operation instruction set and system indicator data according to the specified rules.

[0152] Step 1.1: When a system alarm occurs, extract all abnormal indicator type data from ts (alarm start time) to te (alarm end time) to form an abnormal indicator item set. Simultaneously, label the indicator item set with abnormal change trends, such as sudden increase, sudden decrease, below threshold, above threshold, etc. The system indicator items are shown in Figure 2.1.

[0153] type Indicator Item Equipment layer CPU utilization, memory usage, disk I / O speed, etc. Network layer Network bandwidth utilization, TCP retransmission rate, etc. Application layer JVM heap memory usage, interface response time, etc. Business layer Order conversion rate, payment success rate, etc. Environment layer Data center temperature and humidity (sensors), mains power stability (UPS monitoring), etc.

[0154] Chart 2.1

[0155] Step 1.2: When a system alarm occurs, extract the set of all operation instructions Q (pre-alarm operation set) from 120 seconds before the alarm start time ts (alarm start time) to the time period ts, and record the set of all operation instructions H (post-alarm operation set) from the time period ts to te.

[0156] To improve accuracy, each operation instruction can be labeled with three types of feature tags: instruction type, execution time, and operation object. These feature tags are then used to filter, aggregate, and classify operations, generating a directed operation instruction set. An example rule is as follows:

[0157] (1) The filter instruction type is the instruction to view class tags;

[0158] (2) Instructions that are continuous in time and operate on the same or similar objects are aggregated into a directed operation instruction set in sequence;

[0159] (3) Identify some loop or judgment instructions in the directed operation instruction set and mark them with features. Then, corresponding rules can be set to improve accuracy during subsequent classification and aggregation. For example, the same loop with different numbers of iterations can be classified into one category, and the same judgment statement is only considered to be in the same category if the judgment results are the same, etc.

[0160] Based on the time relationship between the instruction set and the alarm, they are divided into two categories: the preceding operation instruction set and the following operation instruction set, which are stored in the instruction set library respectively.

[0161] Step 2: Based on the processed pre- and post-operation instruction sets and anomaly indicator sets, historical data analysis is performed to generate a relationship model of "pre-operation instruction set - anomaly indicator item set - post-operation instruction set". The Apriori association rule mining algorithm is used to establish association rules. Specifically, these include:

[0162] 2.1 Read the historical data analysis set.

[0163] Retrieve historical operation command sets and system indicator item sets related to the alarm time from the historical operation command set library. Generate the dataset as shown in Table 2.2.

[0164] Serial Number Pre-alarm operation set Abnormal indicators Post-alarm operation set 1 {A, B} W {O, Y, Z} 2 {C, D} N {X, Y, Z} 3 {B, D} W {X, Z} 4 {B} W {Y, Z}

[0165] Table 2.2

[0166] Transaction list definition items:

[0167] Antecedent: Action taken before the alarm (P) + Alarm type (i.e., abnormal indicator) (T)

[0168] Consequence: Post-alarm action (Q)

[0169] The converted transaction list is shown in Table 2.3:

[0170] Serial Number transactions 1 {P_A, P_B, T_W, Q_O, Q_Y, Q_Z} 2 {P_C, P_D, T_N, Q_X, Q_Y, Q_Z} 3 {P_B, P_D, T_W, Q_X, Q_Z} 4 {P_B, T_W, Q_Y, Q_Z}

[0171] Table 2.3

[0172] 2.2 Set the thresholds for the "evaluation metrics" of the association rules, including minimum support (Min_Support) and minimum confidence (Min_Confidence).

[0173] For example, a minimum support level can be set to 20%. This means the itemset must appear in at least 20% of transactions; with a total of 4 transactions, it must appear at least once. A minimum confidence level of 60% can be set. This means the rule's reliability must be ≥60%.

[0174] 2.3 Mine frequent itemsets and generate association rules from them.

[0175] Item set 1 of the single item is generated, as shown in Table 2.4.

[0176] Itemset 1 Number of occurrences Support (number of times / 4) Is it frequent (≥20%)? A 1 25% yes B 3 (Transactions 1, 3, and 4) 75% yes C 1 25% yes D 2 (Transactions 2 and 3) 50% yes W 3 (Transactions 1, 3, and 4) 75% yes N 1 25% yes O 1 25% yes X 2 (Transactions 2 and 3) 50% yes Y 3 (Transactions 1, 2, 4) 75% yes Z 4 (All Transactions) 100% yes

[0177] Table 2.4

[0178] By performing a self-join within the frequent itemset 1, infrequent itemsets are filtered out, and itemset 2 is generated, as shown in Table 2.5.

[0179] Itemset 2 Number of occurrences Support Is it frequent? {B, W} 3 (Transactions 1, 3, and 4) 75% yes {B, X} 1 (Transaction 3) 25% yes {B, Y} 3 (Transactions 1 and 4) 50% yes {W, X} 1 (Transaction 3) 25% yes {B, W, X} 1 (Transaction 3) 25% yes ...

[0180] Table 2.5

[0181] In this way, through repeated iterations, higher-order itemsets are generated based on lower-order frequent itemsets, while infrequent itemsets are filtered out. This process continues until no more higher-order itemsets can be generated, at which point the iteration ends.

[0182] For example:

[0183] Itemset 3{B, W, X} has a support of 25% (occurring once), which satisfies the minimum support requirement.

[0184] Itemset 3{B, W, Y} appears 3 times (transactions 1, 3, 4), with a support of 75%.

[0185] 2.4 Generating Association Rules Based on Frequent Itemsets: Extract association rules from frequent itemsets, calculate confidence scores, and filter rules that meet the minimum confidence score. For a frequent itemset {X, Y} containing "antecedent (P+T)" and "consequence (Q)" (X is the antecedent, Y is the consequence), generate the rule X→Y, and calculate: Confidence (X→Y) = Support (X∪Y) / Support (X).

[0186] For example:

[0187] Rule 1: {B, W} → X

[0188] Support: 25% ({B, W, X} appear in 1 transaction).

[0189] Confidence level: Support ({B, W, X}) / Support ({B, W}) = 25% / 75% ≈ 33% (Does not meet the minimum confidence level of 60%, so it is excluded).

[0190] Rule 2: {B, W} → Y

[0191] Support: 75% ({B, W, Y} appear in 3 transactions).

[0192] Confidence level: 75% / 75% = 100% (condition met).

[0193] Meaning: When "the operation before the alarm includes B and the alarm type is W", "the operation after the alarm will occur 100% of the time".

[0194] Rule 3: {D, N} → X

[0195] Support: 25% ({D, N, X} appears once in transaction 2).

[0196] Confidence level: 25% / 25% = 100% (condition met).

[0197] Meaning: When "the operation before the alarm includes D and the alarm type is N", "the operation after the alarm" will occur 100% of the time.

[0198] Rule 4: {B, D, W} → X

[0199] Support: 25% (occurred once in transaction 3).

[0200] Confidence level: 25% / 25% = 100% (condition met).

[0201] Finally, based on the above conclusions: a strong correlation {B, W} → Y (100% confidence) indicates that "operation B + alarm W" will almost certainly lead to the execution of Y; a moderate correlation {B, D, W} → X (100% confidence, but low support). At this point, a correlation model M of "preceding operation instruction set - abnormal indicator item set - subsequent operation instruction set" can be generated, which is the first correlation model mentioned above.

[0202] Step 3: Based on the operation instruction library, perform historical data analysis to generate a relationship model of "preceding operation instruction set - abnormal indicator item set".

[0203] Using the same method as in step 2, and combining the collected pre-alarm operations, generate the correlation model N of "pre-operation instruction set - abnormal indicator item set".

[0204] Since the second association model is also obtained by training using the same method as the first association model, it will not be elaborated upon further.

[0205] Thus, after training and obtaining the first correlation model and the second correlation model based on the above steps 1, 2 and 3, the pre-alarm operations and the abnormal indicators that generate the alarm are then input into the first correlation model and the second correlation model to obtain the priority of each result operation set.

[0206] For ease of understanding, the specific process of the alarm plan generation method provided in this application embodiment will be described below using a specific embodiment as an example.

[0207] Step 4: Based on the dual-association model obtained in Step 2 and Step 3, select the optimal set of operation results.

[0208] When an alarm occurs, based on the abnormal indicators that generated the alarm and the collected pre-alarm operations, the corresponding association relationship is retrieved from the association rules of the association relationship model M of "preceding operation instruction set - abnormal indicator item set - subsequent operation instruction set". The corresponding subsequent operation instruction set is listed as the result operation, and the confidence (K) and support (J) of each result operation set are listed to obtain the initial priority U=a*K*J (a is the coefficient parameter).

[0209] The obtained set of subsequent operation instructions is used as the preceding operation and then fed into the relationship model N to check if an abnormal indicator item (I) can be obtained. If an abnormal indicator item set cannot be obtained, the priority is a*K*J.

[0210] If an abnormal indicator item set is obtained, the subsequent operation instruction set and the abnormal indicator item set are brought into the association model M to check if there is a subsequent operation instruction set. If not, the new priority U1 = b * U (b is a lower coefficient); if there is, the new priority coefficient U2 = c * U (c is the coefficient calculated from the confidence K1 and support J1 obtained after being brought into the association model M, and c is always greater than b).

[0211] Therefore, the priority U of each subsequent operation instruction set is obtained. Through the above derivation steps, it can be seen that the higher the priority of the contingency plan, the lower the probability of causing secondary failures during execution, and even if secondary failures are possible, the corresponding alarm contingency plan is relatively more comprehensive. In summary, higher priority means higher security and a lower possibility of the impact expanding. Therefore, the obtained contingency plans can be recommended by sorting them according to priority U.

[0212] Step 5: Alarm contingency plan is automatically generated.

[0213] After obtaining the various contingency plans sorted by priority U, the instructions can be automatically completed based on information such as IP, port, and directory address in the abnormal indicators, thus generating the final alarm contingency plan.

[0214] Please see Figure 2 , Figure 2 A schematic diagram of the alarm plan generation device provided in this application embodiment is shown in the figure. The device 200 includes:

[0215] The first acquisition module 210 is used to acquire a first target operation instruction set within a first time period based on a first abnormal indicator set within the acquired alarm time period, wherein the alarm time period and the first time period are consecutive time periods, and the first time period is located before the alarm time period.

[0216] Input module 220 is used to input the first abnormal indicator set and the first target operation instruction set into the first association relationship model;

[0217] The second acquisition module 230 is used to acquire the second target operation instruction set output by the first association model. The second target operation instruction set is a set of subsequent operation instructions in the first association model that correspond to the first abnormal indicator set and the first target operation instruction set.

[0218] The generation module 240 is used to generate an alarm plan based on the highest priority operation instruction combination among N operation instruction combinations. Each operation instruction combination includes at least one abnormal indicator in the first abnormal indicator set, at least one first target operation instruction in the first target operation instruction set, and at least one second target operation instruction in the second target operation instruction set, where N is an integer greater than or equal to 1.

[0219] Optionally, the device 200 further includes:

[0220] Input the second target operation instruction set into the second association model;

[0221] If there is no second abnormal indicator set corresponding to the second target operation instruction set in the second association model, a first target priority is obtained. The first target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set in the first association model.

[0222] Optionally, the device 200 further includes:

[0223] If a second set of abnormal indicators exists in the second association model that corresponds to the second target operation instruction set, the second target operation instruction set and the second set of abnormal indicators are input into the first association model.

[0224] If there is no third target operation instruction set in the first association relationship model, the second target priority is obtained. The second target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set.

[0225] Optionally, the device 200 further includes:

[0226] If a third target operation instruction set exists in the first association model, the priority of the third target is obtained. The priority of the third target is the priority of multiple manipulation instruction combinations corresponding to the first association model and the third target operation instruction set. The third target operation instruction set is the set of subsequent operation instructions in the first association model that correspond to the second target operation instruction set and the second abnormal indicator set.

[0227] Optionally, the first association model includes M operation combination sets, which are generated based on the instruction features of the first historical operation instruction set and the second historical operation instruction set. The instruction features include at least instruction type, execution time, and operation object, where M is an integer greater than 1.

[0228] Optionally, the generation module 240 includes:

[0229] The first acquisition unit is used to acquire the confidence and support of N combinations of operation instructions;

[0230] The second acquisition unit is used to obtain the priority of N operation instruction combinations based on the confidence level and the support level;

[0231] The generation unit is used to generate alarm plans based on the highest priority combination of operation instructions among N operation instruction combinations.

[0232] Optionally, both the first association model and the second association model are generated using the Apriori algorithm.

[0233] It should be noted that the alarm plan generation device provided in this application embodiment is a device capable of executing the above-described alarm plan generation method. Therefore, all implementation methods in the above-described alarm plan generation method embodiments are applicable to this device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further.

[0234] For details, see Figure 3 As shown in the figure, this application embodiment also provides an electronic device, including a bus 301, a transceiver 302, an antenna 303, a bus interface 304, a processor 305, and a memory 306.

[0235] The processor 305 is used for:

[0236] Based on the first abnormal indicator set within the acquired alarm time period, a first target operation instruction set within the first time period is acquired, wherein the alarm time period and the first time period are consecutive time periods, and the first time period is located before the alarm time period.

[0237] The first set of abnormal indicators and the first set of target operation instructions are input into the first association model;

[0238] Obtain the second target operation instruction set output by the first association relationship model. The second target operation instruction set is a set of subsequent operation instructions in the first association relationship model that correspond to the first abnormal indicator set and the first target operation instruction set.

[0239] An alarm plan is generated based on the highest priority operation instruction combination among N operation instruction combinations. Each operation instruction combination includes at least one abnormal indicator from the first abnormal indicator set, at least one first target operation instruction from the first target operation instruction set, and at least one second target operation instruction from the second target operation instruction set, where N is an integer greater than or equal to 1.

[0240] exist Figure 3In this context, a bus architecture (represented by bus 301) is used. Bus 301 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 305 and memory represented by memory 306. Bus 301 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 304 provides an interface between bus 301 and transceiver 302. Transceiver 302 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 305 is transmitted over a wireless medium via antenna 603, which further receives data and transmits it to processor 305.

[0241] Processor 305 manages bus 301 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 306 can be used to store data used by processor 305 during operation.

[0242] Alternatively, the processor 305 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).

[0243] Optionally, the processor 305 is further configured to:

[0244] Input the second target operation instruction set into the second association model;

[0245] If there is no second abnormal indicator set corresponding to the second target operation instruction set in the second association model, a first target priority is obtained. The first target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set in the first association model.

[0246] Optionally, the processor 305 is further configured to:

[0247] If a second set of abnormal indicators exists in the second association model that corresponds to the second target operation instruction set, the second target operation instruction set and the second set of abnormal indicators are input into the first association model.

[0248] If there is no third target operation instruction set in the first association model, the second target priority is obtained. The second target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set. The third target operation instruction set is the set of subsequent operation instructions in the first association model that correspond to the second target operation instruction set and the second abnormal indicator set.

[0249] Optionally, the processor 305 is further configured to:

[0250] If a third target operation instruction set exists in the first association model, the priority of the third target is obtained. The priority of the third target is the priority of multiple manipulation instruction combinations corresponding to the first association model and the third target operation instruction set. The third target operation instruction set is the set of subsequent operation instructions in the first association model that correspond to the second target operation instruction set and the second abnormal indicator set. The priority of the third target is greater than the priority of the second target.

[0251] Optionally, the first association model includes M operation combination sets, which are generated based on the instruction features of the first historical operation instruction set and the second historical operation instruction set. The instruction features include at least instruction type, execution time, and operation object, where M is an integer greater than 1.

[0252] Optionally, the processor 305 is specifically used for:

[0253] Obtain the confidence and support of N combinations of operation instructions;

[0254] Based on the confidence level and the support level, the priority of N operation instruction combinations is obtained;

[0255] An alarm plan is generated based on the highest priority combination of N operation instructions.

[0256] Optionally, both the first association model and the second association model are generated using the Apriori algorithm.

[0257] It should be noted that the electronic device provided in this application embodiment is a device capable of executing the above-described alarm plan generation method. Therefore, all implementation methods in the above-described alarm plan generation method embodiments are applicable to this electronic device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further.

[0258] This invention also provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described alarm plan generation method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0259] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described alarm plan generation method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0260] This application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the various processes of the above-described alarm plan generation method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0261] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0262] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0263] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for generating alarm plans, characterized in that, include: Based on the first abnormal indicator set within the acquired alarm time period, a first target operation instruction set within the first time period is acquired, wherein the alarm time period and the first time period are consecutive time periods, and the first time period is located before the alarm time period. The first set of abnormal indicators and the first set of target operation instructions are input into the first association model; Obtain the second target operation instruction set output by the first association relationship model. The second target operation instruction set is a set of subsequent operation instructions in the first association relationship model that correspond to the first abnormal indicator set and the first target operation instruction set. An alarm plan is generated based on the highest priority operation instruction combination among N operation instruction combinations. Each operation instruction combination includes at least one abnormal indicator from the first abnormal indicator set, at least one first target operation instruction from the first target operation instruction set, and at least one second target operation instruction from the second target operation instruction set, where N is an integer greater than or equal to 1.

2. The method according to claim 1, characterized in that, After outputting the second target operation instruction set and before generating an alarm plan based on the highest priority operation instruction combination among N operation instruction combinations, the method further includes: Input the second target operation instruction set into the second association model; If there is no second abnormal indicator set corresponding to the second target operation instruction set in the second association model, a first target priority is obtained. The first target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set in the first association model.

3. The method according to claim 2, characterized in that, The method further includes: If a second set of abnormal indicators exists in the second association model that corresponds to the second target operation instruction set, the second target operation instruction set and the second set of abnormal indicators are input into the first association model. If there is no third target operation instruction set in the first association model, the second target priority is obtained. The second target priority is the priority of multiple operation instruction combinations corresponding to the second target operation instruction set. The third target operation instruction set is the set of subsequent operation instructions in the first association model that correspond to the second target operation instruction set and the second abnormal indicator set.

4. The method according to claim 3, characterized in that, The method further includes: In the case where a third target operation instruction set exists in the first association model, the priority of the third target is obtained. The priority of the third target is the priority of multiple manipulation instruction combinations corresponding to the third target operation instruction set in the first association model. The third target operation instruction set is the set of subsequent operation instructions corresponding to the second target operation instruction set and the second abnormal indicator set in the first association model. The priority of the third target is greater than the priority of the second target.

5. The method according to any one of claims 1-4, characterized in that, The first association model includes M operation combination sets, which are generated based on the instruction features of the first historical operation instruction set and the second historical operation instruction set. The instruction features include at least instruction type, execution time and operation object, and M is an integer greater than 1.

6. The method according to claim 1, characterized in that, The alarm plan is generated based on the highest priority combination of N operation instructions, including: Obtain the confidence and support of N combinations of operation instructions; Based on the confidence level and the support level, the priority of N operation instruction combinations is obtained; An alarm plan is generated based on the highest priority combination of N operation instructions.

7. The method according to claim 3, characterized in that, Both the first association model and the second association model are generated using the Apriori algorithm.

8. An alarm contingency plan generation device, characterized in that, include: The first acquisition module is used to acquire a first target operation instruction set within a first time period based on a first abnormal indicator set within the acquired alarm time period, wherein the alarm time period and the first time period are consecutive time periods, and the first time period is located before the alarm time period. The input module is used to input the first set of abnormal indicators and the first set of target operation instructions into the first association model; The second acquisition module is used to acquire the second target operation instruction set output by the first association relationship model. The second target operation instruction set is a set of subsequent operation instructions in the first association relationship model that correspond to the first abnormal indicator set and the first target operation instruction set. The generation module is used to generate an alarm plan based on the highest priority operation instruction combination among N operation instruction combinations. Each operation instruction combination includes at least one abnormal indicator in the first abnormal indicator set, at least one first target operation instruction in the first target operation instruction set, and at least one second target operation instruction in the second target operation instruction set, where N is an integer greater than or equal to 1.

9. An electronic device, characterized in that, include: The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the alarm plan generation method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps in the alarm plan generation method as described in any one of claims 1 to 7.

Images